Vendor
An unauthenticated remote attacker can exploit a path traversal vulnerability in Cimetrics BACstac to read or overwrite arbitrary files via maliciously crafted BACnet File Object names.