Lucene search

[email protected]CVE-2022-31479

HistoryJun 06, 2022 - 5:15 p.m.

CVE-2022-31479

2022-06-0617:15:10

CWE-78

CWE-693

[email protected]

web.nvd.nist.gov

cve-2022-31479

hid mercury intelligent controllers

firmware vulnerability

remote access

command injection

security threat

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.5%

JSON

An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable. The injected commands only get executed during start up or when unsafe calls regarding the hostname are used. This allows the attacker to gain remote access to the device and can make their persistence permanent by modifying the filesystem.

Affected configurations

NVD

Node

hidgloballp1501_firmwareRange<1.302

AND

hidgloballp1501Match-

Node

hidgloballp1502_firmwareRange<1.302

AND

hidgloballp1502Match-

Node

hidgloballp2500Match-

AND

hidgloballp2500_firmwareRange<1.302

Node

hidgloballp4502Match-

AND

hidgloballp4502_firmwareRange<1.302

Node

hidglobalep4502Match-

AND

hidglobalep4502_firmwareRange<1.296

Node

carrierlenels2_lnl-4420Match-

AND

carrierlenels2_lnl-4420_firmwareRange<1.296

Node

carrierlenels2_lnl-x2210Match-

AND

carrierlenels2_lnl-x2210_firmwareRange<1.302

Node

carrierlenels2_lnl-x2220Match-

AND

carrierlenels2_lnl-x2220_firmwareRange<1.302

Node

carrierlenels2_lnl-x3300Match-

AND

carrierlenels2_lnl-x3300_firmwareRange<1.302

Node

carrierlenels2_lnl-x4420Match-

AND

carrierlenels2_lnl-x4420_firmwareRange<1.302

Node

carrierlenels2_s2-lp-1501_firmwareRange<1.302

AND

carrierlenels2_s2-lp-1501Match-

Node

carrierlenels2_s2-lp-1502_firmwareRange<1.302

AND

carrierlenels2_s2-lp-1502Match-

Node

carrierlenels2_s2-lp-2500_firmwareRange<1.302

AND

carrierlenels2_s2-lp-2500Match-

Node

carrierlenels2_s2-lp-4502_firmwareRange<1.302

AND

carrierlenels2_s2-lp-4502Match-

CPENameOperatorVersion
hidglobal:lp1501_firmwarehidglobal lp1501 firmwarelt1.302

CPE	Name	Operator	Version
hidglobal:lp1501_firmware	hidglobal lp1501 firmware	lt	1.302

CNA Affected

[
  {
    "product": "LNL-X2210",
    "vendor": "LenelS2",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "LNL-X2220",
    "vendor": "LenelS2",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "LNL-X3300",
    "vendor": "LenelS2",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "LNL-X4420",
    "vendor": "LenelS2",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "LNL-4420",
    "vendor": "LenelS2",
    "versions": [
      {
        "lessThan": "1.296",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "S2-LP-1501",
    "vendor": "LenelS2",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "S2-LP-1502",
    "vendor": "LenelS2",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "S2-LP-2500",
    "vendor": "LenelS2",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "S2-LP-4502",
    "vendor": "LenelS2",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "LP1501",
    "vendor": "HID Mercury",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "LP1502",
    "vendor": "HID Mercury",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "LP2500",
    "vendor": "HID Mercury",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "LP4502",
    "vendor": "HID Mercury",
    "versions": [
      {
        "lessThan": "1.302",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "EP4502",
    "vendor": "HID Mercury",
    "versions": [
      {
        "lessThan": "1.296",
        "status": "affected",
        "version": "ALL",
        "versionType": "custom"
      }
    ]
  }
]

References

www.corporate.carrier.com/product-security/advisories-resources/

Social References

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.5%

JSON

Related for CVE-2022-31479

cvelist1 prion1 nvd1 cnvd1 trellix6 thn1 ics1