Carlo Gavazzi Controls: Multiple Vulnerabilities in Controller UWP 3.0
The UWP 3.0 family of Monitoring Gateways and Controllers and the CPY Car Park Server are affected by multiple vulnerabilities in their set-up software, runtime firmware, embedded Web interface.
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-28816US | — | — | ||
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service. | ||||
| CVE-2022-28815US | — | — | ||
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an a… | ||||
| CVE-2022-28814US | — | — | ||
Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote a… | ||||
| CVE-2022-28813US | — | — | ||
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a vola… | ||||
| CVE-2022-28812US | —OT elevated | — | ||
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser… | ||||
| CVE-2022-28811US | — | — | ||
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submit… | ||||
| CVE-2022-22526US | —OT elevated | — | ||
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a missing authentication allows for full access via API. | ||||
| CVE-2022-22525US | — | — | ||
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input san… | ||||
| CVE-2022-22524US | critical9.4 | — | ||
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full da… | ||||
| CVE-2022-22523US | high7.5 | — | ||
An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication byp… | ||||
| CVE-2022-22522US | —OT elevated | — | ||
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full acces… | ||||
references
External citations — patches, advisories, analysis.
remediations (11)
- Fixed
Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
- Fixed
Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
- Fixed
Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
- Fixed
Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
- Fixed
Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
- Fixed
Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
- Fixed
Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
- Fixed
Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
- Fixed
Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
- Fixed
Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
- Fixed
Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan