CVE-2022-28815

published 2022-09-28

CVE-2022-28815: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection…

Priority P4 16 low 2.7 CVSS 3.1

AV N AC L PR H UI N S U C L I N A N

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sentilo service.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
carlo_gavazzi	cpy_car_park_server	>= 2 < 2.8.3	2.8.3
carlo_gavazzi	uwp_3.0_monitoring_gateway_and_controller	>= 8 < 8.5.0.3	8.5.0.3
carlo_gavazzi	uwp_3.0_monitoring_gateway_and_controller_edp_version	>= 8 < 8.5.0.3	8.5.0.3
carlo_gavazzi	uwp_3.0_monitoring_gateway_and_controller_security_enhanced	>= 8 < 8.5.0.3	8.5.0.3
gavazziautomation	cpy_car_park_server	< 2.8.3	2.8.3
gavazziautomation	uwp_3.0_monitoring_gateway_and_controller_firmware	< 8.5.0.3	8.5.0.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89