Skip to content
CVE Tracker
Back

CVE-2022-28811

Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0

Critical9.8EPSS 1.3%
Published
Updated
Reserved
Assigned by
CERTVDE

Description

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS commands.

Scores

CVSS scores of CVE-2022-28811, by who scored it
Scored byCVSSScoreVector
CERTVDECNA (assigner)3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
1.3% · top 30% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

Affected products

  • Carlo Gavazzi · UWP 3.0 Monitoring Gateway and Controller

    • affected 8 – < 8.5.0.3

  • Carlo Gavazzi · UWP 3.0 Monitoring Gateway and Controller – Security Enhanced

    • affected 8 – < 8.5.0.3

  • Carlo Gavazzi · UWP 3.0 Monitoring Gateway and Controller – EDP version

    • affected 8 – < 8.5.0.3

  • Carlo Gavazzi · CPY Car Park Server

    • affected 2 – < 2.8.3

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .