CVE-2022-22525

Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection

State: Published
Severity: 7.2 High
Published: Sep 28, 2022
Updated: May 21, 2025
Reserved: Jan 3, 2022

Description

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
UWP 3.0 Monitoring Gateway and ControllerCarlo Gavazzi	8 to before 8.5.0.3Affected
UWP 3.0 Monitoring Gateway and Controller – Security EnhancedCarlo Gavazzi	8 to before 8.5.0.3Affected
UWP 3.0 Monitoring Gateway and Controller – EDP versionCarlo Gavazzi	8 to before 8.5.0.3Affected
CPY Car Park ServerCarlo Gavazzi	2 to before 2.8.3Affected

References

https://cert.vde.com/en/advisories/VDE-2022-029/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.