Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park Server

Vulnerability

The vulnerability is a missing authentication flaw in the Carlo Gavazzi UWP 3.0 family of Monitoring Gateways and Controllers (multiple versions) and the CPY Car Park Server (version 2.8.3). The API endpoints do not require any authentication, allowing unauthenticated access to the device's API [1].

Exploitation

An attacker with network access to the affected device can directly call the API without any prior authentication, user interaction, or special privileges. The only requirement is that the device is reachable over the network [1].

Impact

Successful exploitation grants the attacker full access to the device via the API. This can lead to complete compromise of the device's functionality, including potential control, data disclosure, and disruption of services [1].

Mitigation

Carlo Gavazzi has released firmware updates for the affected products. Users should update to the latest firmware version as provided by the vendor. For specific version details, refer to the vendor advisory [1]. If patching is not immediately possible, isolate the devices from untrusted networks as a workaround.