1. Home
  2. CVE Database
  3. CVE-2022-31480
HIGH · 7.5

CVE-2022-31480

An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelli...

Vulnerability Description

An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The attacker needs to have a properly signed and encrypted binary, loading the firmware to the device ultimately triggers a reboot.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
HidglobalLp1501 Firmware< 1.302
HidglobalLp1501-
HidglobalLp1502 Firmware< 1.302
HidglobalLp1502-
HidglobalLp2500 Firmware< 1.302
HidglobalLp2500-
HidglobalLp4502 Firmware< 1.302
HidglobalLp4502-
HidglobalEp4502 Firmware< 1.296
HidglobalEp4502-
CarrierLenels2 Lnl-4420 Firmware< 1.296
CarrierLenels2 Lnl-4420-
CarrierLenels2 Lnl-X2210 Firmware< 1.302
CarrierLenels2 Lnl-X2210-
CarrierLenels2 Lnl-X2220 Firmware< 1.302
CarrierLenels2 Lnl-X2220-
CarrierLenels2 Lnl-X3300 Firmware< 1.302
CarrierLenels2 Lnl-X3300-
CarrierLenels2 Lnl-X4420 Firmware< 1.302
CarrierLenels2 Lnl-X4420-

Related Weaknesses (CWE)

CWE-425

References

FAQ

What is CVE-2022-31480?

CVE-2022-31480 is a vulnerability with a CVSS score of 7.5 (HIGH). An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelli...

How severe is CVE-2022-31480?

CVE-2022-31480 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-31480?

Check the references section above for vendor advisories and patch information. Affected products include: Hidglobal Lp1501 Firmware, Hidglobal Lp1501, Hidglobal Lp1502 Firmware, Hidglobal Lp1502, Hidglobal Lp2500 Firmware.