CVE-2022-22525

Summary

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function

Affected Software

VendorProductVersion RangeStatus
Carlo GavazziUWP 3.0 Monitoring Gateway and Controller8 < 8.5.0.3affected
Carlo GavazziUWP 3.0 Monitoring Gateway and Controller – Security Enhanced8 < 8.5.0.3affected
Carlo GavazziUWP 3.0 Monitoring Gateway and Controller – EDP version8 < 8.5.0.3affected
Carlo GavazziCPY Car Park Server2 < 2.8.3affected

Weaknesses

  • CWE-20: CWE-20 Improper Input Validation

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References