Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass

7.5 CVSS

Vulnerability Description

An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-22523

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Vera Mens from Claroty Research

References

https://cert.vde.com/en/advisories/VDE-2022-029/

More from Carlo Gavazzi

View All →

CVE-2022-28816

Reflected XSS in Carlo Gavazzi UWP 3.0

Medium 6.1

CVE-2022-28815

SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy

Low 2.7

CVE-2022-28814

Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access

Critical 9.8

CVE-2022-28813

SQL-injection in Car Park Server 3.0 allows for full database access.

High 7.5

CVE-2022-28812

Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.

Critical 9.8

Affected Vendor

Carlo Gavazzi

View all reports →

Affected Software

UWP 3.0 Monitoring Gateway and Controller, UWP 3.0 Monitoring Gateway and Controller – Security Enhanced, UWP 3.0 Monitoring Gateway and Controller – EDP version, CPY Car Park Server

Vulnerable Versions:

8, 2