Advisories · Technology

Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – EDP version.

Every CVE that names Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – EDP version among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2022-28816 CVE record

CVSS 6.1 Medium

Reflected XSS in Carlo Gavazzi UWP 3.0
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Cross-site scripting (XSS)
Not analysed yet 28 Sept 2022
CVE-2022-28815 CVE record

CVSS 2.7 Low

SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- SQL injection
Not analysed yet 28 Sept 2022
CVE-2022-28814 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Path traversal
Not analysed yet 28 Sept 2022
CVE-2022-28812 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Hard-coded credentials
Not analysed yet 28 Sept 2022
CVE-2022-28811 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Command injection
Not analysed yet 28 Sept 2022
CVE-2022-22526 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park Server
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Authentication bypass
Not analysed yet 28 Sept 2022
CVE-2022-22525 CVE record

CVSS 7.2 High

Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- CWE-20
Not analysed yet 28 Sept 2022
CVE-2022-22524 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- SQL injection
Not analysed yet 28 Sept 2022
CVE-2022-22523 CVE record

CVSS 7.5 High

Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Authentication bypass
Not analysed yet 28 Sept 2022
CVE-2022-22522 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- Hard-coded credentials
Not analysed yet 28 Sept 2022
CVE-2022-28813 CVE record

CVSS 7.5 High

SQL-injection in Car Park Server 3.0 allows for full database access.
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced
- SQL injection
Not analysed yet 28 Sept 2022