source: http://www.securityfocus.com/bid/2374/info

Making an invalid request to a machine running Brightstation Muscat, will disclose the physical path to the root directory. 

http://target/cgi-bin/empower?DB=UkRteamHole
http://target/cgi-bin/empower?DB=UkRteamHole