Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection

Vulnerability

The backup restore function in Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server version 2.8.3 lacks input sanitization, allowing command injection. An attacker with administrative privileges can exploit this flaw to execute arbitrary operating system commands on the device. The affected products are part of the UWP 3.0 family of Monitoring Gateways and Controllers and the CPY Car Park Server [1].

Exploitation

An attacker must have network access to the device and possess valid administrative credentials. The attacker can craft a malicious backup file or input that, when processed by the restore function, injects arbitrary commands. The restore function does not validate or sanitize the input, leading to command execution with the privileges of the device's runtime environment [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the affected device, leading to full system compromise. This can result in unauthorized data access, modification, or deletion, as well as potential disruption of device operations. The attacker gains complete control over the device's functionality [1].

Mitigation

Carlo Gavazzi has released firmware updates to address this vulnerability. Users should update UWP3.0 devices to the latest available version and CPY Car Park Server to a patched version as specified in the vendor advisory. No workarounds are documented; applying the fix is the recommended mitigation [1].