1. Home
  2. CVE Database
  3. CVE-2022-31481
CRITICAL · 10.0

CVE-2022-31481

An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, ...

Vulnerability Description

An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The overflowed data can allow the attacker to manipulate the “normal” code execution to that of their choosing. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.

CVSS Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
HidglobalLp1501 Firmware< 1.302
HidglobalLp1501-
HidglobalLp1502 Firmware< 1.302
HidglobalLp1502-
HidglobalLp2500 Firmware< 1.302
HidglobalLp2500-
HidglobalLp4502 Firmware< 1.302
HidglobalLp4502-
HidglobalEp4502 Firmware< 1.296
HidglobalEp4502-
CarrierLenels2 Lnl-4420 Firmware< 1.296
CarrierLenels2 Lnl-4420-
CarrierLenels2 Lnl-X2210 Firmware< 1.302
CarrierLenels2 Lnl-X2210-
CarrierLenels2 Lnl-X2220 Firmware< 1.302
CarrierLenels2 Lnl-X2220-
CarrierLenels2 Lnl-X3300 Firmware< 1.302
CarrierLenels2 Lnl-X3300-
CarrierLenels2 Lnl-X4420 Firmware< 1.302
CarrierLenels2 Lnl-X4420-

Related Weaknesses (CWE)

CWE-120

References

FAQ

What is CVE-2022-31481?

CVE-2022-31481 is a vulnerability with a CVSS score of 10.0 (CRITICAL). An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, ...

How severe is CVE-2022-31481?

CVE-2022-31481 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-31481?

Check the references section above for vendor advisories and patch information. Affected products include: Hidglobal Lp1501 Firmware, Hidglobal Lp1501, Hidglobal Lp1502 Firmware, Hidglobal Lp1502, Hidglobal Lp2500 Firmware.