Lucene search

K
cvelistCERTVDECVELIST:CVE-2022-22522
HistorySep 28, 2022 - 1:45 p.m.

CVE-2022-22522 Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device

2022-09-2813:45:28
CWE-798
CERTVDE
www.cve.org
cve-2022-22522
hard-coded credentials
authentication bypass
full control
carlo gavazzi uwp3.0
cpy car park server
remote attacker
unauthenticated

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.5%

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.

CNA Affected

[
  {
    "product": "UWP 3.0 Monitoring Gateway and Controller",
    "vendor": "Carlo Gavazzi",
    "versions": [
      {
        "lessThan": "8.5.0.3",
        "status": "affected",
        "version": "8",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "UWP 3.0 Monitoring Gateway and Controller – Security Enhanced",
    "vendor": "Carlo Gavazzi",
    "versions": [
      {
        "lessThan": "8.5.0.3",
        "status": "affected",
        "version": "8",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "UWP 3.0 Monitoring Gateway and Controller – EDP version",
    "vendor": "Carlo Gavazzi",
    "versions": [
      {
        "lessThan": "8.5.0.3",
        "status": "affected",
        "version": "8",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "CPY Car Park Server",
    "vendor": "Carlo Gavazzi",
    "versions": [
      {
        "lessThan": "2.8.3",
        "status": "affected",
        "version": "2",
        "versionType": "custom"
      }
    ]
  }
]

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.5%

Related for CVELIST:CVE-2022-22522