Advisories · Technology

Carlo Gavazzi CPY Car Park Server.

Every CVE that names Carlo Gavazzi CPY Car Park Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2022-28816 CVE record

CVSS 6.1 Medium

Reflected XSS in Carlo Gavazzi UWP 3.0
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Cross-site scripting (XSS)
Not analysed yet 28 Sept 2022
CVE-2022-28815 CVE record

CVSS 2.7 Low

SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- SQL injection
Not analysed yet 28 Sept 2022
CVE-2022-28814 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Path traversal
Not analysed yet 28 Sept 2022
CVE-2022-28812 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Hard-coded credentials
Not analysed yet 28 Sept 2022
CVE-2022-28811 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Command injection
Not analysed yet 28 Sept 2022
CVE-2022-22526 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park Server
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Authentication bypass
Not analysed yet 28 Sept 2022
CVE-2022-22525 CVE record

CVSS 7.2 High

Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- CWE-20
Not analysed yet 28 Sept 2022
CVE-2022-22524 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- SQL injection
Not analysed yet 28 Sept 2022
CVE-2022-22523 CVE record

CVSS 7.5 High

Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Authentication bypass
Not analysed yet 28 Sept 2022
CVE-2022-22522 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Hard-coded credentials
Not analysed yet 28 Sept 2022
CVE-2022-28813 CVE record

CVSS 7.5 High

SQL-injection in Car Park Server 3.0 allows for full database access.
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- SQL injection
Not analysed yet 28 Sept 2022