CVE-2022-22524

published 2022-09-28

CVE-2022-22524: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection…

Priority P2 63 critical 9.4 CVSS 3.1

AV N AC L PR N UI N S U C H I L A H

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services .

Affected

6 ranges

Vendor	Product	Version range	Fixed in
carlo_gavazzi	cpy_car_park_server	>= 2 < 2.8.3	2.8.3
carlo_gavazzi	uwp_3.0_monitoring_gateway_and_controller	>= 8 < 8.5.0.3	8.5.0.3
carlo_gavazzi	uwp_3.0_monitoring_gateway_and_controller_edp_version	>= 8 < 8.5.0.3	8.5.0.3
carlo_gavazzi	uwp_3.0_monitoring_gateway_and_controller_security_enhanced	>= 8 < 8.5.0.3	8.5.0.3
gavazziautomation	cpy_car_park_server	< 2.8.3	2.8.3
gavazziautomation	uwp_3.0_monitoring_gateway_and_controller_firmware	< 8.5.0.3	8.5.0.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89