7.2
CVE-2022-22525
- EPSS 0.97%
- Veröffentlicht 28.09.2022 14:15:10
- Zuletzt bearbeitet 21.11.2024 06:46:57
- Quelle info@cert.vde.com
- CVE-Watchlists
- Unerledigt
LoginCommand injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gavazziautomation ≫ Cpy Car Park Server Version < 2.8.3
Gavazziautomation ≫ Uwp 3.0 Monitoring Gateway And Controller Firmware Version < 8.5.0.3
Gavazziautomation ≫ Uwp 3.0 Monitoring Gateway And Controller Firmware Editionedp Version < 8.5.0.3
Gavazziautomation ≫ Uwp 3.0 Monitoring Gateway And Controller Firmware Editionsecurity_enhanced Version < 8.5.0.3
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.97% | 0.573 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| info@cert.vde.com | 7.2 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
https://cert.vde.com/en/advisories/VDE-2022-029/