Reflected XSS in Carlo Gavazzi UWP 3.0

6.1 CVSS

Vulnerability Description

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-28816

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Vera Mens from Claroty Research

References

https://cert.vde.com/en/advisories/VDE-2022-029/

More from Carlo Gavazzi

View All →

CVE-2022-28815

SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy

Low 2.7

CVE-2022-28814

Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access

Critical 9.8

CVE-2022-28813

SQL-injection in Car Park Server 3.0 allows for full database access.

High 7.5

CVE-2022-28812

Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.

Critical 9.8

CVE-2022-28811

Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0

Critical 9.8

Affected Vendor

Carlo Gavazzi

View all reports →

Affected Software

UWP 3.0 Monitoring Gateway and Controller, UWP 3.0 Monitoring Gateway and Controller – Security Enhanced, UWP 3.0 Monitoring Gateway and Controller – EDP version, CPY Car Park Server

Vulnerable Versions:

8, 2