Summary
The UWP 3.0 family of Monitoring Gateways and Controllers and the CPY Car Park Server are affected by multiple vulnerabilities in their set-up software, runtime firmware, embedded Web interface.
Details
Impact
An attacker can get full access to the affected devices. See the vulnerability descriptions for details.
General recommendations
Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside
Use firewalls to protect and separate the control system network from other networks
Use VPN (Virtual Private Networks) tunnels if remote access is required
Activate and apply user management and password features
Use encrypted communication links
Limit the access to both set-up and control system by physical means, operating system features, etc.
Protect the set-up and control system by using up to date virus detecting solutions
Remediation
Please update to software/firmware versions as described below:
| Article Nr. | Product Name and Description | Fixed in version |
|------------------|---------------------------------------------------------------|--------------------------|
| UWP30RSEXXX | UWP 3.0 Monitoring Gateway and Controller | >= 8.5.0.3 (available from April 27th, 2022) |
| UWP30RSEXXXSE | UWP 3.0 Monitoring Gateway and Controller – Security Enhanced | >= 8.5.0.3 (available from April 27th, 2022) |
| UWP30RSEXXXEDP | UWP 3.0 Monitoring Gateway and Controller – EDP version | >= 8.5.0.3 (available from April 27th, 2022) |
| SBP2CPY24 | CPY Car Park Server | >= 2.8.3 (available from June 28th, 2022) |
Vulnerabilities 11
-
Critical 9.8
Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.
-
Critical 9.8
Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park Server
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a missing authentication allows for full access via API.
-
Critical 9.8
Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS commands.
-
Critical 9.8
Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device.
-
Critical 9.8
Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access
Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device.
-
Critical 9.4
SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services .
-
High 7.5
Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass
An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled.
-
High 7.5
SQL-injection in Car Park Server 3.0 allows for full database access.
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device.
-
High 7.2
Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function
-
Medium 6.1
Reflected XSS in Carlo Gavazzi UWP 3.0
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service.
-
Low 2.7
SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sentilo service.
Revision history
-
#5.0.0
Fixed publisher name and switched to semver versioning
-
#4.0.0
Fix: added distribution
-
#3.0.0
Fix: version range, remove Issuing authority
-
#2.0.0
Fix: added self-reference
-
#1.0.0
Initial revision.
References
-
VDE-2022-029: Carlo Gavazzi Controls: Multiple Vulnerabilities in Controller UWP 3.0 - HTML
https://certvde.com/de/advisories/VDE-2022-029/
-
CERT@VDE Security Advisories for Carlo Gavazzi Controls SpA
https://certvde.com/de/advisories/vendor/gavazzi-controls/