Carel manufactures industrial climate-control and HVAC management systems, with a focused product portfolio centered on embedded web cards and controller firmware such as the PCOWeb and Boss Mini lines that serve building automation and refrigeration infrastructure. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code, while the durable weakness classes center on path traversal, missing authentication controls, and sensitive-information exposure—flaws that reflect the network-embedded and often internet-reachable nature of these controllers. Defenders should treat this vendor's advisories as high-priority for any exposed or internet-facing instances; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Carel over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-3643CRITICAL A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. The manipulation of the | Jul 12, 2023 | 9.8 | 85 | NO | YES |
CVE-2022-37122HIGH Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vul | Aug 31, 2022 | 7.5 | 46 | NO | YES |
CVE-2019-11369HIGH An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext passwords, which may allow sensitive information to be read by s | Jun 3, 2019 | 8.8 | 40 | NO | YES |
CVE-2019-11370MEDIUM Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" field. | Jun 3, 2019 | 5.4 | 37 | NO | YES |
CVE-2022-34827CRITICAL Carel Boss Mini 1.5.0 has Improper Access Control. | Nov 18, 2022 | 9.9 | 30 | NO | NO |
CVE-2019-13553CRITICAL Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded cre | Oct 25, 2019 | 9.8 | 29 | NO | NO |
CVE-2011-3487MEDIUM Directory traversal vulnerability in CarelDataServer.exe in Carel PlantVisor 2.4.4 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET req | Sep 16, 2011 | 5.0 | 28 | NO | YES |
CVE-2020-18329HIGH An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unauthenticated access to the configuration | Jan 26, 2023 | 7.5 | 24 | NO | NO |
CVE-2019-13549HIGH Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not provide a sufficient leve | Oct 25, 2019 | 7.5 | 23 | NO | NO |
CVE-2016-0867HIGH CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request. | Jan 30, 2016 | 7.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Carel.
Media articles that mention a CVE ID that affects a product developed by Carel — matched by CVE ID, not by vendor name.