Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access

9.8 CVSS

Vulnerability Description

Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-28814

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Vera Mens from Claroty Research

References

https://cert.vde.com/en/advisories/VDE-2022-029/

More from Carlo Gavazzi

View All →

CVE-2022-28816

Reflected XSS in Carlo Gavazzi UWP 3.0

Medium 6.1

CVE-2022-28815

SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy

Low 2.7

CVE-2022-28813

SQL-injection in Car Park Server 3.0 allows for full database access.

High 7.5

CVE-2022-28812

Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.

Critical 9.8

CVE-2022-28811

Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0

Critical 9.8

Affected Vendor

Carlo Gavazzi

View all reports →

Affected Software

UWP 3.0 Monitoring Gateway and Controller, UWP 3.0 Monitoring Gateway and Controller – Security Enhanced, UWP 3.0 Monitoring Gateway and Controller – EDP version, CPY Car Park Server

Vulnerable Versions:

8, 2