SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access

Vulnerability

The affected products are Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server version 2.8.3. A SQL injection vulnerability exists in the embedded web interface, allowing an unauthenticated attacker to inject arbitrary SQL commands.

Exploitation

An unauthenticated remote attacker can exploit this by sending crafted HTTP requests to the affected devices. No authentication or user interaction is required.

Impact

Successful exploitation grants the attacker full access to the device's database. The attacker can read, modify, or delete data, create or modify users, and stop services, leading to a complete compromise of confidentiality, integrity, and availability.

Mitigation

As of the publication date (2022-09-28), no official patches have been released. Users should apply network segmentation and restrict access to the devices. The vendor has been notified; updates are expected. [1]