CVE-2022-28813 in UWP
Summary
by MITRE • 09/28/2022
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/20/2026
The vulnerability identified as CVE-2022-28813 affects Carlo Gavazzi UWP3.0 devices and CPY Car Park Server version 2.8.3, representing a critical security flaw that allows remote attackers to execute unauthorized database operations without authentication. This issue stems from insufficient input validation within the affected systems' web interfaces, creating an avenue for malicious actors to manipulate database queries through crafted input parameters. The vulnerability specifically targets the temporary database functionality that maintains real-time operational states of the devices, making it particularly concerning for industrial control systems and parking management infrastructure.
The technical exploitation of this SQL injection vulnerability occurs when an attacker submits maliciously formatted input to the affected web application interfaces. This input bypasses normal validation mechanisms and gets directly incorporated into database queries, allowing the attacker to manipulate the underlying database structure. The temporary database in question contains current operational states of the device, including real-time parking information, device status, and potentially sensitive operational data. This database access capability enables attackers to not only extract information but also potentially modify device states or manipulate the parking system's operational behavior. The vulnerability is classified under CWE-89 as SQL injection, which represents one of the most prevalent and dangerous web application security flaws in the industry.
The operational impact of this vulnerability extends beyond simple data exposure, as it compromises the integrity and availability of critical parking infrastructure systems. An attacker with successful exploitation could gain unauthorized access to real-time parking data, potentially enabling them to disrupt parking operations, manipulate access controls, or extract sensitive information about vehicle movements and parking patterns. The temporary database access capability means that attackers could potentially observe current device states and operational parameters, which might include information about system vulnerabilities, device configurations, or operational metrics that could be leveraged for further attacks. This vulnerability particularly affects industrial control environments where system integrity is paramount, and unauthorized access could lead to operational disruptions or safety concerns.
Mitigation strategies for this vulnerability require immediate attention from system administrators and security teams responsible for the affected Carlo Gavazzi and CPY systems. The primary remediation involves implementing proper input validation and parameterized queries to prevent malicious SQL code from being executed within the database context. Organizations should deploy web application firewalls and input sanitization mechanisms to filter out potentially malicious database queries before they reach the backend systems. Additionally, implementing network segmentation and access controls can limit the potential impact of successful exploitation attempts. System updates and patches should be applied immediately if available from the vendors, and network monitoring should be enhanced to detect suspicious database access patterns or unusual query activity. The vulnerability also highlights the importance of following secure coding practices and conducting regular security assessments of industrial control systems to identify and remediate similar weaknesses before they can be exploited by malicious actors. This case demonstrates the critical need for robust security measures in industrial environments where system integrity directly impacts operational safety and business continuity.