Read the docs
TI-2022-06801 Aliases CVE-2022-22525GHSA-pqh4-f68f-fc23

Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection

Priority LOW 36CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01199 68th percentileScored 2026-11-07
Fix Fixed UWP 3.0 Monitoring Gateway and Controller (Carlo Gavazzi): 8.5.0.3UWP 3.0 Monitoring Gateway and Controller – Security Enhanced (Carlo Gavazzi): 8.5.0.3+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Carlo GavazziUWP 3.0 Monitoring Gateway and Controller8 to before 8.5.0.38.5.0.3Patch availableCNA
Carlo GavazziUWP 3.0 Monitoring Gateway and Controller – Security Enhanced8 to before 8.5.0.38.5.0.3Patch availableCNA
Carlo GavazziUWP 3.0 Monitoring Gateway and Controller – EDP version8 to before 8.5.0.38.5.0.3Patch availableCNA
Carlo GavazziCPY Car Park Server2 to before 2.8.32.8.3Patch availableCNA
  • UWP 3.0 Monitoring Gateway and Controller VendorCarlo Gavazzi Affected 8 to before 8.5.0.3 Fixed in 8.5.0.3 Patch available CNA
  • UWP 3.0 Monitoring Gateway and Controller – Security Enhanced VendorCarlo Gavazzi Affected 8 to before 8.5.0.3 Fixed in 8.5.0.3 Patch available CNA
  • UWP 3.0 Monitoring Gateway and Controller – EDP version VendorCarlo Gavazzi Affected 8 to before 8.5.0.3 Fixed in 8.5.0.3 Patch available CNA
  • CPY Car Park Server VendorCarlo Gavazzi Affected 2 to before 2.8.3 Fixed in 2.8.3 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:gavazziautomation:cpy_car_park_server:*:*:*:*:*:*:*:*before 2.8.3VulnerableCarlo Gavazzi
cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:*:*:*:*:*:*before 8.5.0.3VulnerableCarlo Gavazzi
cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:*:*:*:*:*:*not specified by NVDRunning onCarlo Gavazzi
cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:edp:*:*:*:*:*before 8.5.0.3VulnerableCarlo Gavazzi
cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:edp:*:*:*:*:*not specified by NVDRunning onCarlo Gavazzi
cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:security_enhanced:*:*:*:*:*before 8.5.0.3VulnerableCarlo Gavazzi
cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:security_enhanced:*:*:*:*:*not specified by NVDRunning onCarlo Gavazzi
  • cpe:2.3:a:gavazziautomation:cpy_car_park_server:*:*:*:*:*:*:*:* Versions before 2.8.3 Vulnerable ·Carlo Gavazzi
  • cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:*:*:*:*:*:* Versions before 8.5.0.3 Vulnerable ·Carlo Gavazzi
  • cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Carlo Gavazzi
  • cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:edp:*:*:*:*:* Versions before 8.5.0.3 Vulnerable ·Carlo Gavazzi
  • cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:edp:*:*:*:*:* Versions not specified by NVD Running on ·Carlo Gavazzi
  • cpe:2.3:o:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller_firmware:*:*:security_enhanced:*:*:*:*:* Versions before 8.5.0.3 Vulnerable ·Carlo Gavazzi
  • cpe:2.3:h:gavazziautomation:uwp_3.0_monitoring_gateway_and_controller:-:*:security_enhanced:*:*:*:*:* Versions not specified by NVD Running on ·Carlo Gavazzi

Remediation

  • Fix · CNA UWP 3.0 Monitoring Gateway and Controller (Carlo Gavazzi) Fixed in 8.5.0.3
  • Fix · CNA UWP 3.0 Monitoring Gateway and Controller – Security Enhanced (Carlo Gavazzi) Fixed in 8.5.0.3
  • Fix · CNA UWP 3.0 Monitoring Gateway and Controller – EDP version (Carlo Gavazzi) Fixed in 8.5.0.3
  • Fix · CNA CPY Car Park Server (Carlo Gavazzi) Fixed in 2.8.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Carlo Gavazzi CPY Car Park Server, UWP 3.0 Monitoring Gateway and Controller and 2 more products 2.8.3, 8.5.0.3

    11 records Highest priority Priority MEDIUM 8 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2022-11433 Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0Priority MEDIUM 51
    • TI-2022-06800 SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database accessPriority MEDIUM 51
    • TI-2022-06798 Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the devicePriority MEDIUM 51
    Show all 11 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22525
  2. 2026-10-03 Alias added: GHSA-pqh4-f68f-fc23

References

Advisory 1

  • TI-2022-11433 Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0 CVSS 3.1CRITICAL 9.8
  • TI-2022-06800 SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access CVSS 3.1CRITICAL 9.4
  • TI-2022-06798 Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device CVSS 3.1CRITICAL 9.8
  • TI-2022-06802 Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park Server CVSS 3.1CRITICAL 9.8
  • TI-2022-11436 Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access CVSS 3.1CRITICAL 9.8
  • TI-2022-11434 Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server. CVSS 3.1CRITICAL 9.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences