CVE-2022-28811

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS commands.

Score

CVSS 3.1 9.8 Critical

Status

Modified - info@cert.vde.com

Published

2022-09-28

Last modified

2025-05-21

Weaknesses

CWE-78

Affected products

• Cpy Car Park Server (Carlo Gavazzi)
• Uwp 3.0 Monitoring Gateway And Controller (Carlo Gavazzi)
• Uwp 3.0 Monitoring Gateway And Controller Edp Version (Carlo Gavazzi)
• Uwp 3.0 Monitoring Gateway And Controller Security Enhanced (Carlo Gavazzi)
• Cpy Car Park Server (Gavazziautomation)
• Uwp 3.0 Monitoring Gateway And Controller Firmware (Gavazziautomation)

References

• https://cert.vde.com/en/advisories/VDE-2022-029/