# CVE-2021-4463: BEMS API - Arbitrary File Read

> Live exploitation tracking for CVE-2021-4463 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-4463

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.7
- **Public exploit available:** Yes
- **Affected products:** Shenzhen Longjing Technology Co. Ltd. BEMS API
- **Weaknesses:** CWE-552 (Files or Directories Accessible to External Parties); CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** web_application, enterprise_software

## Description

Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.

## CrowdSec analysis

[CVE-2021-4463](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-4463) is a high-severity vulnerability in Longjing Technology BEMS API up to version 1.21, where the 'downloads' endpoint fails to properly sanitize the 'fileName' parameter. This flaw allows unauthenticated attackers to exploit directory traversal and download arbitrary files from the server, potentially exposing sensitive system or configuration data. Attackers could leverage this vulnerability to gain unauthorized access to confidential information, increasing the risk of further compromise.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of June 2026.

CrowdSec network observations suggest that most exploitation of CVE-2021-4463 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
CrowdSec network telemetry also shows that exploitation of CVE-2021-4463 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the `/api/downloads` endpoint by supplying directory traversal sequences in the `fileName` parameter to download arbitrary files from the server.

## Timeline

- 2025-11-12: CVE Published. CVE-2021-4463 is published to NVD.
- 2026-06-03: Rule Released. CrowdSec releases a rule to detect CVE-2021-4463 exploitation attempts against the CrowdSec Network.
- 2026-06-05: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-4463 for the first time.

## References

- https://packetstormsecurity.com/files/163702
- https://web.archive.org/web/20220527162453/http://www.ljkj2012.com/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/206477
- https://cxsecurity.com/issue/WLB-2021070173
- https://www.vulncheck.com/advisories/longjing-technology-bems-api-remote-arbitrary-file-download
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4463.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-4463) follows observed exploitation activity for CVE-2021-4463. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.