CVE-2022-28812

published 2022-09-28

CVE-2022-28812: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded…

Priority P2 71 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
carlo_gavazzi	cpy_car_park_server	>= 2 < 2.8.3	2.8.3
carlo_gavazzi	uwp_3.0_monitoring_gateway_and_controller	>= 8 < 8.5.0.3	8.5.0.3
carlo_gavazzi	uwp_3.0_monitoring_gateway_and_controller_edp_version	>= 8 < 8.5.0.3	8.5.0.3
carlo_gavazzi	uwp_3.0_monitoring_gateway_and_controller_security_enhanced	>= 8 < 8.5.0.3	8.5.0.3
gavazziautomation	cpy_car_park_server	< 2.8.3	2.8.3
gavazziautomation	uwp_3.0_monitoring_gateway_and_controller_firmware	< 8.5.0.3	8.5.0.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-798