{"id":"CVE-2022-22525","state":"PUBLISHED","title":"Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection","description":"In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function","publishedAt":"2022-09-28T13:45:30.000Z","updatedAt":"2025-05-21T14:36:52.620Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"CERTVDE"},"assigner":"CERTVDE","products":["Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller","Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – Security Enhanced","Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller – EDP version","Carlo Gavazzi CPY Car Park Server"],"affected":[{"vendor":"Carlo Gavazzi","product":"UWP 3.0 Monitoring Gateway and Controller","versions":[{"version":"8","status":"affected","lessThan":"8.5.0.3","versionType":"custom"}]},{"vendor":"Carlo Gavazzi","product":"UWP 3.0 Monitoring Gateway and Controller – Security Enhanced","versions":[{"version":"8","status":"affected","lessThan":"8.5.0.3","versionType":"custom"}]},{"vendor":"Carlo Gavazzi","product":"UWP 3.0 Monitoring Gateway and Controller – EDP version","versions":[{"version":"8","status":"affected","lessThan":"8.5.0.3","versionType":"custom"}]},{"vendor":"Carlo Gavazzi","product":"CPY Car Park Server","versions":[{"version":"2","status":"affected","lessThan":"2.8.3","versionType":"custom"}]}],"references":["https://cert.vde.com/en/advisories/VDE-2022-029/"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T19:49:38.433Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/22xxx/CVE-2022-22525.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-22525","state":"PUBLISHED","datePublished":"2022-09-28T13:45:30.000Z","dateUpdated":"2025-05-21T14:36:52.620Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2022-01-03T00:00:00.000Z"},"containers":{"cna":{"title":"Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection","descriptions":[{"lang":"en","value":"In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function"}],"affected":[{"vendor":"Carlo Gavazzi","product":"UWP 3.0 Monitoring Gateway and Controller","versions":[{"version":"8","status":"affected","lessThan":"8.5.0.3","versionType":"custom"}]},{"vendor":"Carlo Gavazzi","product":"UWP 3.0 Monitoring Gateway and Controller – Security Enhanced","versions":[{"version":"8","status":"affected","lessThan":"8.5.0.3","versionType":"custom"}]},{"vendor":"Carlo Gavazzi","product":"UWP 3.0 Monitoring Gateway and Controller – EDP version","versions":[{"version":"8","status":"affected","lessThan":"8.5.0.3","versionType":"custom"}]},{"vendor":"Carlo Gavazzi","product":"CPY Car Park Server","versions":[{"version":"2","status":"affected","lessThan":"2.8.3","versionType":"custom"}]}],"references":[{"url":"https://cert.vde.com/en/advisories/VDE-2022-029/","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","dateUpdated":"2022-09-28T13:45:30.000Z","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c"},"credits":[{"lang":"en","value":"Vera Mens from Claroty Research"}],"source":{"advisory":"VDE-2022-029","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"info@cert.vde.com","ID":"CVE-2022-22525","STATE":"PUBLIC","TITLE":"Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"UWP 3.0 Monitoring Gateway and Controller","version":{"version_data":[{"version_affected":"<","version_name":"8","version_value":"8.5.0.3"}]}},{"product_name":"UWP 3.0 Monitoring Gateway and Controller – Security Enhanced","version":{"version_data":[{"version_affected":"<","version_name":"8","version_value":"8.5.0.3"}]}},{"product_name":"UWP 3.0 Monitoring Gateway and Controller – EDP version","version":{"version_data":[{"version_affected":"<","version_name":"8","version_value":"8.5.0.3"}]}},{"product_name":"CPY Car Park Server","version":{"version_data":[{"version_affected":"<","version_name":"2","version_value":"2.8.3"}]}}]},"vendor_name":"Carlo Gavazzi"}]}},"credit":[{"lang":"eng","value":"Vera Mens from Claroty Research"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function"}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-20 Improper Input Validation"}]}]},"references":{"reference_data":[{"name":"https://cert.vde.com/en/advisories/VDE-2022-029/","refsource":"CONFIRM","url":"https://cert.vde.com/en/advisories/VDE-2022-029/"}]},"source":{"advisory":"VDE-2022-029","discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://cert.vde.com/en/advisories/VDE-2022-029/","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T03:14:55.414Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-21T14:36:46.092109Z","id":"CVE-2022-22525","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-21T14:36:52.620Z"}}]}}}