Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access

Vulnerability

Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server version 2.8.3 are affected by a relative path traversal vulnerability [1]. The flaw resides in the device's web interface, allowing an attacker to traverse directories outside the intended web root.

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HTTP requests containing path traversal sequences (e.g., ../) to read arbitrary files on the device [1]. No user interaction or special privileges are required.

Impact

Successful exploitation enables the attacker to read sensitive files, such as configuration files or credentials, potentially leading to full compromise of the device [1]. The advisory notes that an attacker can gain full access to the affected devices.

Mitigation

As of the publication date of the advisory (2022-09-26), no official fix has been released by Carlo Gavazzi [1]. Users are advised to restrict network access to the affected devices and monitor for updates from the vendor.