An adversary having user account can read any file on the system. He can then among other things:

  • Read /etc/shadow and try to recover the service password to ssh to the machine
  • Read the web interface credentials in /ubr/config/user.cfg and try to recover their passwords
  • Read the private key of the https server (/ubr/etc/certs/httpd.pem) or the BACnet/SC service(/ubr/etc/certs/1_srvr-pkey.pem).

CWE: CWE-863:Incorrect Authorization