Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – EDP version

• CVE-2022-28816 Medium 6.1 Reflected XSS in Carlo Gavazzi UWP 3.0 0.4%
• CVE-2022-28815 Low 2.7 SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy 0.5%
• CVE-2022-28814 Critical 9.8 Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access 1.3%
• CVE-2022-28812 Critical 9.8 Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server. 1.0%
• CVE-2022-28811 Critical 9.8 Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0 1.3%
• CVE-2022-22526 Critical 9.8 Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park Server 0.9%
• CVE-2022-22525 High 7.2 Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection 1.2%
• CVE-2022-22524 Critical 9.4 SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access 1.2%
• CVE-2022-22523 High 7.5 Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass 0.9%
• CVE-2022-22522 Critical 9.8 Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device 1.2%
• CVE-2022-28813 High 7.5 SQL-injection in Car Park Server 3.0 allows for full database access. 1.0%