CVE-2022-28813

highpriority · track · 0EPSS 0.010 · 64 %ileCHEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.03% (64th) EPSS
CVSS 7.5 · high
Is it mine?
14 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · carlo_gavazzi_psirt · nvd

EPSS · scored 2026-10-27

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedcarlo_gavazzi_psirt

    Please update to software/firmware versions as described below: | Article Nr. | Product Name and Description | Fixed in version | |------------------|---------------------------------------------------------------|--------------------------| | UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) | | UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) | | SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · NVD / NIST USexploitability 3.9 · impact 3.6
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · info@cert.vde.comexploitability 3.9 · impact 3.6
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Carlo Gavazzi PSIRT
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-89USCWE-89US
04

affected products (14)

Products and version ranges known to be affected.

05

advisories (1)

Vendor and ecosystem advisories describing this.

  • VDE-2022-029Carlo Gavazzi Controls: Multiple Vulnerabilities in Controller UWP 3.02022-09-26csaf · carlo_gavazzi_psirtCH

    The UWP 3.0 family of Monitoring Gateways and Controllers and the CPY Car Park Server are affected by multiple vulnerabilities in their set-up software, runtime firmware, embedded Web interface.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcarlo_gavazzi_psirtnvdNVDCVE.orgMITRE
published 2022-09-28modified 2026-06-17
08

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan