CVE-2022-22526

CVE-2022-22526 affects Carlo Gavazzi UWP3.0 and CPY Car Park Server (v2.8.3). The root cause is a missing authentication mechanism that allows full access via the API, enabling unauthorized control or data access. Public sources in connected documents describe an access control error leading to r...

CVE-2022-22524

CVE-2022-22524 affects Carlo Gavazzi UWP3.0 and CPY Car Park Server (v2.8.3). Multiple sources describe a SQL injection that allows an unauthenticated remote attacker to gain full database access, modify users, and stop services. The affected components include UWP3.0 monitoring gateway/controlle...

CVE-2022-22525 Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function...

CVE-2022-22524 SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services...

CVE-2022-22525

The CVE-2022-22525 affects Carlo Gavazzi UWP3.0 and CPY Car Park Server 2.8.3. It stems from missing input sanitization in the backup restore function, enabling a remote attacker with admin rights to execute arbitrary commands. Connections across sources consistently identify the affected compone...

CVE-2022-22525 Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function...

CVE-2022-22524 SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services...

CVE-2022-22523 Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass

An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled...

CVE-2022-22523

CVE-2022-22523 involves an improper authentication issue in Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server Web-App 2.8.3, enabling an authentication bypass for unauthorised users when free-access is disabled. Supported sources indicate the vulnerability affects Carlo Gavazzi UWP...

CVE-2022-22523 Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass

An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled...

CVE-2022-22522 Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device...

CVE-2022-22522 Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device...

CVE-2022-22522

CVE-2022-22522 affects Carlo Gavazzi UWP3.0 and CPY Car Park Server 2.8.3, where a remote, unauthenticated attacker could exploit hard-coded credentials to gain full access to the device. The vulnerability is described as trust/credential management issues enabling authentication bypass and full ...

Carlo Gavazzi UWP 跨站脚本漏洞

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. It is used for applications such as building automation, energy efficiency performance management and parking lot guidance. A cross-site scripting vulnerability exists in Carlo Gavazzi UWP 3.0, which can be...

Carlo Gavazzi UWP 信任管理问题漏洞

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. for applications such as building automation, energy efficiency performance management and parking lot guidance. A trust management issue vulnerability exists in Carlo Gavazzi UWP 3.0, which can be exploited ...

Carlo Gavazzi UWP SQL注入漏洞

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. for applications such as building automation, energy efficiency performance management and parking lot guidance. Carlo Gavazzi UWP 3.0 suffers from a SQL injection vulnerability that can be exploited by a...

Carlo Gavazzi UWP 操作系统命令注入漏洞

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. for applications such as building automation, energy efficiency performance management and parking lot guidance. An operating system command injection vulnerability exists in Carlo Gavazzi UWP 3.0, which can ...

Carlo Gavazzi UWP 输入验证错误漏洞

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. for applications such as building automation, energy efficiency performance management, and parking lot guidance. An input validation error vulnerability exists in Carlo Gavazzi UWP 3.0, which stems from a la...

Carlo Gavazzi UWP SQL注入漏洞

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. for applications such as building automation, energy efficiency performance management and parking lot guidance. A SQL injection vulnerability exists in Carlo Gavazzi UWP 3.0, which originates from a Sentilo...

CVE-2022-28813

CVE-2022-28813 affects Carlo Gavazzi UWP3.0 and CPY Car Park Server 2.8.3. A remote, unauthenticated SQL injection could access a volatile temporary database containing current device states. CVSSv3.1: 7.5 (HIGH); Attack Vector: NETWORK; Attack Complexity: LOW; Privileges Required: NONE; User Int...