Carlo Gavazzi vulnerabilities
We track 8 vulnerabilities in Carlo Gavazzi products across 4 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on September 28, 2022.
Latest Carlo Gavazzi vulnerabilities
- 9.8 Critical severity
UWP 3.0 Monitoring Gateway and Controller: Improper Limitation of a Pathname to a Restricted Directory
Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device.
- 7.5 High severity
UWP 3.0 Monitoring Gateway and Controller: Improper Neutralization of Special Elements used in an SQL Command
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device.
- 9.8 Critical severity
UWP 3.0 Monitoring Gateway and Controller: Use of Hard-coded Credentials
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device.
- 9.8 Critical severity
UWP 3.0 Monitoring Gateway and Controller: Improper Neutralization of Special Elements used in an OS Command
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS commands.
- 7.2 High severity
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an…
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function
- 9.4 Critical severity
UWP 3.0 Monitoring Gateway and Controller: Improper Neutralization of Special Elements used in an SQL Command
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services .
- 7.5 High severity
UWP 3.0 Monitoring Gateway and Controller: Improper Authentication
An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled.
- 9.8 Critical severity
UWP 3.0 Monitoring Gateway and Controller: Use of Hard-coded Credentials
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.