External risk intelligence

KevinLAB 4ST BEMS SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2021-37291

The vulnerability exists in a Building Energy Management System (BEMS), which is a web-based application designed to manage facility infrastructure. Such systems are commonly deployed with web interfaces that are often made accessible via internal networks or directly exposed to the internet for remote monitoring and management purposes.

SQL Injection

Kevinlab 4st L Bems

1.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects KevinLAB Inc. Building Energy Management System software. It allows unauthenticated remote attackers to potentially compromise system integrity and data confidentiality via a SQL injection flaw. The main concern is confirming relevance and exposure to our operational technology.

SQL injection flaw in energy management software.
Compromises data and system integrity remotely.
Confirm relevance and exposure to operations.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the vulnerable web application. The vulnerability lies in how the application handles user input through the `input_id` parameter when processing requests to `index.php`. If this input is not properly validated or sanitized, it could allow an attacker to inject malicious SQL code, potentially leading to unauthorized access, data modification, or denial of service.

No authentication or special access needed.
Via the `input_id` parameter in `index.php`.
Allows SQL injection leading to data compromise.

Live Threat

Current exploitation, exposure, and threat context

An SQL Injection vulnerability in the Building Energy Management System could allow an attacker to execute arbitrary SQL commands. This may affect system operations and data integrity when the system is accessible over a network.

System data could be accessed.
Unauthenticated network access could trigger it.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the KevinLAB Building Energy Management System impacts system owners and infrastructure teams responsible for the BEMS. The first practical step is to locate all instances of this system, assess their exposure and criticality, identify the accountable owner, and then prioritize remediation efforts based on risk.

Identify system owners and asset owners.
Verify BEMS reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is KevinLAB 4ST BEMS?

KevinLAB 4ST BEMS is a Building Energy Management System designed to monitor and control infrastructure, such as HVAC, lighting, and power systems, within a facility. It provides a centralized web-based interface for operators to track energy usage and manage operational settings. Because it handles sensitive facility data and physical controls, it acts as a critical component in maintaining building efficiency and automation.

How does CVE-2021-37291 work?

This vulnerability is an SQL Injection, classified as CWE-89. It happens when software fails to properly sanitize user input, allowing an attacker to insert their own commands into the application's database queries. In this specific case, the flaw allows unauthorized parties to manipulate the database through the 'input_id' parameter, potentially giving them full control over the information stored within the management system.

What triggers this SQL injection flaw?

An attacker triggers this vulnerability by sending a specially crafted request containing malicious SQL code to the 'input_id' parameter in 'index.php'. Because the system does not require authentication or special user privileges to process this specific request, the vulnerability can be exploited by anyone who can reach the web interface over a network. Actions that do not involve sending data to this specific parameter will not trigger the bug.

Is my organization at risk for this vulnerability?

Risk depends on your network architecture. Halo Surface Signal identifies that because this is a web-based management system, it is frequently placed on internal networks for facility management or directly exposed to the internet for remote access. If your instance of 4ST BEMS is reachable from the internet or accessible to untrusted network segments, it is at higher risk of unauthorized exploitation.

How do I start addressing this issue?

Your first step is to perform an inventory of your environment to locate all running instances of KevinLAB 4ST BEMS. Once identified, verify their network reachability and criticality to your operations. Coordinate with the designated system owners to determine the appropriate path forward, prioritizing remediation based on the sensitivity of the data managed by the system and the level of network exposure.

References

www.kevinlab.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.