Read the docs

Carlo Gavazzi

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

Carlo Gavazzi records in CISA KEV

No Carlo Gavazzi vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Cpy Car Park Server 11 records MEDIUM Uwp 3.0 Monitoring Gateway And Controller Firmware 11 records MEDIUM

Records

11 records in Uwp 3.0 Monitoring Gateway And Controller Firmware · all components

TI-2022-11433 CVE-2022-28811 · GHSA-55mr-m33j-9g77

Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0

Priority MEDIUM 51

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS co…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01268 Published 2022-09-28 Fixed in 8.5.0.3, 2.8.3 CWE-78
TI-2022-06800 CVE-2022-22524 · GHSA-wjp6-jx63-6237

SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access

Priority MEDIUM 51

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop ser…

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.01231 Published 2022-09-28 Fixed in 8.5.0.3, 2.8.3 CWE-89
TI-2022-06798 CVE-2022-22522 · GHSA-9f53-qp4r-c23f

Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device

Priority MEDIUM 51

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01157 Published 2022-09-28 Fixed in 8.5.0.3, 2.8.3 CWE-798
TI-2022-11436 CVE-2022-28814 · GHSA-jhgj-cw4j-x999

Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access

Priority MEDIUM 45

Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gai…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01318 Published 2022-09-28 Fixed in 8.5.0.3, 2.8.3 CWE-23
TI-2022-11434 CVE-2022-28812 · GHSA-8928-2v8p-qcc3

Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.

Priority MEDIUM 44

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01049 Published 2022-09-28 Fixed in 8.5.0.3, 2.8.3 CWE-798
TI-2022-11435 CVE-2022-28813 · GHSA-rpx2-2gcg-95v4

SQL-injection in Car Park Server 3.0 allows for full database access.

Priority MEDIUM 41

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01034 Published 2022-09-28 Fixed in 8.5.0.3, 2.8.3 CWE-89
TI-2022-06799 CVE-2022-22523 · GHSA-69hr-qqmq-cf8v

Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass

Priority MEDIUM 41

An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised us…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00883 Published 2022-09-28 Fixed in 8.5.0.3, 2.8.3 CWE-287
TI-2022-06801 CVE-2022-22525 · GHSA-pqh4-f68f-fc23

Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection

Priority LOW 36

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01199 Published 2022-09-28 Fixed in 8.5.0.3, 2.8.3 CWE-20
TI-2022-11438 CVE-2022-28816 · GHSA-q4jp-hjwm-c743

Reflected XSS in Carlo Gavazzi UWP 3.0

Priority LOW 28

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2022-09-28 Fixed in 8.5.0.3, 2.8.3 CWE-79
TI-2022-11437 CVE-2022-28815 · GHSA-xcx6-c483-32rq

SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy

Priority LOW 14

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sen…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00537 Published 2022-09-28 Fixed in 8.5.0.3, 2.8.3 CWE-89
Open these records in search →