CVE-2022-28814 — Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access

Description (CNA)

Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device.

Affected (CNA)

Vendor / product	Versions
Carlo Gavazzi / UWP 3.0 Monitoring Gateway and Controller	affected 8 before 8.5.0.3
Carlo Gavazzi / UWP 3.0 Monitoring Gateway and Controller – Security Enhanced	affected 8 before 8.5.0.3
Carlo Gavazzi / UWP 3.0 Monitoring Gateway and Controller – EDP version	affected 8 before 8.5.0.3
Carlo Gavazzi / CPY Car Park Server	affected 2 before 2.8.3

CWE

CWE-23

References

https://cert.vde.com/en/advisories/VDE-2022-029/

ADP enrichment

CVE

No English description supplied.

https://cert.vde.com/en/advisories/VDE-2022-029/

CISA-ADP

No English description supplied.

No references supplied.