Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device

Vulnerability

Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server version 2.8.3 contain hard-coded credentials embedded in the device firmware and web interface. An attacker who can reach the device over the network can use these credentials to authenticate without any prior knowledge or access.

Exploitation

A remote, unauthenticated attacker with network access to the affected device can leverage the hard-coded credentials to log in to the web interface or other services. No user interaction or special privileges are required. The attacker simply identifies the device and uses the known credentials to gain authenticated access.

Impact

Successful exploitation grants the attacker full administrative access to the device. This includes the ability to read and modify configuration settings, control device operations, and potentially disrupt services or cause physical damage depending on the deployment context.

Mitigation

Carlo Gavazzi has released firmware updates to address this vulnerability; users should upgrade to the latest version provided by the vendor. If patching is not immediately possible, restrict network access to the device to trusted hosts only and monitor for unauthorized access attempts. [1]