Read the docs
TI-2022-06798 Aliases CVE-2022-22522GHSA-9f53-qp4r-c23f

Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device

Priority MEDIUM 51CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01157 67th percentileScored 2026-11-07
Fix Fixed UWP 3.0 Monitoring Gateway and Controller (Carlo Gavazzi): 8.5.0.3UWP 3.0 Monitoring Gateway and Controller – Security Enhanced (Carlo Gavazzi): 8.5.0.3+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Carlo GavazziUWP 3.0 Monitoring Gateway and Controller8 to before 8.5.0.38.5.0.3Patch availableCNA
Carlo GavazziUWP 3.0 Monitoring Gateway and Controller – Security Enhanced8 to before 8.5.0.38.5.0.3Patch availableCNA
Carlo GavazziUWP 3.0 Monitoring Gateway and Controller – EDP version8 to before 8.5.0.38.5.0.3Patch availableCNA
Carlo GavazziCPY Car Park Server2 to before 2.8.32.8.3Patch availableCNA
  • UWP 3.0 Monitoring Gateway and Controller VendorCarlo Gavazzi Affected 8 to before 8.5.0.3 Fixed in 8.5.0.3 Patch available CNA
  • UWP 3.0 Monitoring Gateway and Controller – Security Enhanced VendorCarlo Gavazzi Affected 8 to before 8.5.0.3 Fixed in 8.5.0.3 Patch available CNA
  • UWP 3.0 Monitoring Gateway and Controller – EDP version VendorCarlo Gavazzi Affected 8 to before 8.5.0.3 Fixed in 8.5.0.3 Patch available CNA
  • CPY Car Park Server VendorCarlo Gavazzi Affected 2 to before 2.8.3 Fixed in 2.8.3 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:gavazziautomation:cpy_car_park_server:*:*:*:*:*:*:*:*before 2.8.3VulnerableCarlo Gavazzi
cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:*:*:*:*:*:*before 8.5.0.3VulnerableCarlo Gavazzi
cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:*:*:*:*:*:*not specified by NVDRunning onCarlo Gavazzi
cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:edp:*:*:*:*:*before 8.5.0.3VulnerableCarlo Gavazzi
cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:edp:*:*:*:*:*not specified by NVDRunning onCarlo Gavazzi
cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:security_enhanced:*:*:*:*:*before 8.5.0.3VulnerableCarlo Gavazzi
cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:security_enhanced:*:*:*:*:*not specified by NVDRunning onCarlo Gavazzi
  • cpe:2.3:a:gavazziautomation:cpy_car_park_server:*:*:*:*:*:*:*:* Versions before 2.8.3 Vulnerable ·Carlo Gavazzi
  • cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:*:*:*:*:*:* Versions before 8.5.0.3 Vulnerable ·Carlo Gavazzi
  • cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Carlo Gavazzi
  • cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:edp:*:*:*:*:* Versions before 8.5.0.3 Vulnerable ·Carlo Gavazzi
  • cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:edp:*:*:*:*:* Versions not specified by NVD Running on ·Carlo Gavazzi
  • cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:security_enhanced:*:*:*:*:* Versions before 8.5.0.3 Vulnerable ·Carlo Gavazzi
  • cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:security_enhanced:*:*:*:*:* Versions not specified by NVD Running on ·Carlo Gavazzi

Remediation

  • Fix · CNA UWP 3.0 Monitoring Gateway and Controller (Carlo Gavazzi) Fixed in 8.5.0.3
  • Fix · CNA UWP 3.0 Monitoring Gateway and Controller – Security Enhanced (Carlo Gavazzi) Fixed in 8.5.0.3
  • Fix · CNA UWP 3.0 Monitoring Gateway and Controller – EDP version (Carlo Gavazzi) Fixed in 8.5.0.3
  • Fix · CNA CPY Car Park Server (Carlo Gavazzi) Fixed in 2.8.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Carlo Gavazzi CPY Car Park Server, UWP 3.0 Monitoring Gateway and Controller and 2 more products 2.8.3, 8.5.0.3

    11 records Highest priority Priority MEDIUM 8 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2022-11433 Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0Priority MEDIUM 51
    • TI-2022-06800 SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database accessPriority MEDIUM 51
    • TI-2022-06802 Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park ServerPriority MEDIUM 50
    Show all 11 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22522
  2. 2026-10-03 Alias added: GHSA-9f53-qp4r-c23f

References

Advisory 1

  • TI-2022-11433 Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0 CVSS 3.1CRITICAL 9.8
  • TI-2022-06800 SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access CVSS 3.1CRITICAL 9.4
  • TI-2022-06802 Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park Server CVSS 3.1CRITICAL 9.8
  • TI-2022-11436 Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access CVSS 3.1CRITICAL 9.8
  • TI-2022-11434 Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server. CVSS 3.1CRITICAL 9.8
  • TI-2022-11435 SQL-injection in Car Park Server 3.0 allows for full database access. CVSS 3.1HIGH 7.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences