Cimetrics BACnet Explorer version 4.0 suffers from an XML eXternal Entity vulnerability that allows for remote retrieval of arbitrary data.