Skip to content
OpenAdvisories
Critical · 9.8 CVE-2022-22526 EUVD-2022-27672GHSA-7hhj-936p-m562

Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park Server

Published Sep 28, 2022 · Updated May 21, 2025 · Assigned by CERTVDE

Vendor: Carlo Gavazzi Automation Product: CPY Car Park Server Product: UWP 3.0 Monitoring Gateway and Controller Product: UWP 3.0 Monitoring Gateway and Controller – EDP version Product: UWP 3.0 Monitoring Gateway and Controller – Security Enhanced

Description

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a missing authentication allows for full access via API.

Affected products

VendorProductAffectedFixed
Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller 8 – < 8.5.0.3 8.5.0.3
Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced 8 – < 8.5.0.3 8.5.0.3
Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – EDP version 8 – < 8.5.0.3 8.5.0.3
Carlo Gavazzi CPY Car Park Server 2 – < 2.8.3 2.8.3

Advisories 1

References