2022年10月4日,

2022年10月04,由愛德華·科瓦奇近十幾個漏洞被發現在一個停車場管理係統由意大利公司卡洛Gavazzi,這使得電子控製組件來構建和工業自動化。缺陷是由研究人員發現工業網絡安全公司在卡洛Gavazzi Claroty CPY停車場服務器和UWP 3.0監控網關和控製器產品。供應商在今年早些時候發布補丁對受影響的產品。德國(郵件保護),協調披露漏洞影響工業控製係統(ICS)和操作技術(OT)的歐洲供應商的產品,描述卡洛Gavazzi問題發表了一個顧問。(電子郵件保護)的顧問描述11漏洞,以及該機構警告說,攻擊者可以利用他們“完全訪問受影響的設備”。維拉犯罪,Claroty安全研究員認為,電子郵件保護漏洞報告,告訴SecurityWeek UWP影響產品設計是一個基於web的應用程序遠程建築自動化管理,能源管理,停車場引導係統,為司機提供停車位停車設施內的可用性的信息。“UWP監控網關是一個多用途設備能夠運行多種監控服務器,用於不同的目的,”男子解釋道。“例如,CPY停車場服務器是一個函數的UWP 3.0設備用於監視和控製其他設備在一個停車場,跟蹤可用的停車位。在這個例子中,在每一個停車位有傳感器檢測是否有一輛車。傳感器報告CPY停車場總量數據服務器,提供分析(如能力隨著時間的推移),協調整個操作。” These products have been found to be affected by critical vulnerabilities related to hardcoded credentials, SQL injection, missing authentication, improper input validation, and path traversals, as well as several high-severity issues. These security holes can be exploited to bypass authentication, obtain information, and execute commands, allowing an attacker to take full control of the targeted system. Fortunately, Mens said Claroty is not aware of any UWP devices exposed on the internet, which means an attacker would have to gain access to the targeted network to exploit the vulnerabilities. However, an attacker who can gain access to the targeted network could leverage the vulnerabilities to conduct various activities. “The vulnerabilities are exploitable and can lead to various attack scenarios, including exploiting the monitoring device and faking monitoring data, controlling the nested devices such as remote controllers and sensors in order to disrupt a physical process, and more,” Mens explained. The researcher said the vendor quickly fixed all the vulnerabilities. According to [email protected] , UWP3.0 version 8.5.0.3 and newer and CPY Car Park Server version 2.8.3 and newer address the flaws. The cybersecurity agency has also shared some general recommendations for preventing these types of attacks.