Reflected XSS in Carlo Gavazzi UWP 3.0

Vulnerability

The Sentilo Proxy component in Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server version 2.8.3 is vulnerable to reflected cross-site scripting (XSS). The vulnerability exists due to insufficient input validation of user-supplied data, allowing an attacker to inject arbitrary JavaScript code that reflects off the server. [1]

Exploitation

An attacker can craft a malicious URL that, when accessed by a user (e.g., through phishing), causes the Sentilo service to execute the injected script in the user's browser. No authentication is required, but the attack relies on user interaction such as clicking a link. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the Sentilo service. This could lead to session hijacking, defacement, or redirection to malicious sites, affecting the confidentiality and integrity of the Sentilo service data. [1]

Mitigation

Carlo Gavazzi has released updated firmware and software versions. Users should update to the latest versions as indicated in the vendor advisory VDE-2022-029. [1] If no patch is available for a specific version, restrict access to the Sentilo service interface to trusted networks.