What’s Vulnerable › Vulnerabilities

CVE-2021-4463: Longjing Technology BEMS API <= 1.21 Remote Arbitrary File Download

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-12 · updated 2026-06-17
• Weakness: CWE-22

Description

Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.

Affected products

• Shenzhen Longjing Technology Co. Ltd. BEMS API: through 1.21

References

• https://cxsecurity.com/issue/WLB-2021070173
• https://exchange.xforce.ibmcloud.com/vulnerabilities/206477
• https://packetstormsecurity.com/files/163702
• https://web.archive.org/web/20220527162453/http://www.ljkj2012.com/
• https://www.exploit-db.com/exploits/50163
• https://www.vulncheck.com/advisories/longjing-technology-bems-api-remote-arbitrary-file-download
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php

Get alerted when CVE-2021-4463 or the next vulnerability affects your stack