CVE-2022-22524: falha crítica em Carlo Gavazzi CPY Car Park Server
SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.4epss 1.2%
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services .
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Produtos afetados
Carlo Gavazzi · CPY Car Park ServerCarlo Gavazzi · UWP 3.0 Monitoring Gateway and ControllerCarlo Gavazzi · UWP 3.0 Monitoring Gateway and Controller – EDP versionCarlo Gavazzi · UWP 3.0 Monitoring Gateway and Controller – Security EnhancedCVEs relacionadas — Carlo Gavazzi CPY Car Park Server
No mesmo produto, das mais perigosas para as menos.
CVE-2022-28814CRITICALPath traversal in Carlo Gavazzi UWP 3.0 could lead to full device accessEPSS 1.3%CVE-2022-28811CRITICALPossible command injection in Car Park Server in Carlo Gavazzi UWP3.0EPSS 1.3%CVE-2022-22525HIGHCommand injection in restore function of Carlo Gavazzi UWP3.0 allows for command injectionEPSS 1.2%CVE-2022-22522CRITICALHard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the deviceEPSS 1.2%CVE-2022-28812CRITICALUse of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.EPSS 1.0%CVE-2022-28813HIGHSQL-injection in Car Park Server 3.0 allows for full database access.EPSS 1.0%