An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository.
https://www.exploit-db.com/exploits/45384/
https://github.com/SadFud/Exploits/tree/master/Real%20World/Suites/cir-pwn-life