1. Home
  2. CVE Database
  3. CVE-2022-31482
HIGH · 7.5

CVE-2022-31482

An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Con...

Vulnerability Description

An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The overflowed data leads to segmentation fault and ultimately a denial-of-service condition, causing the device to reboot. The impact of this vulnerability is that an unauthenticated attacker could leverage this flaw to cause the target device to become unresponsive. An attacker could automate this attack to achieve persistent DoS, effectively rendering the target controller useless.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
HidglobalLp1501 Firmware< 1.29
HidglobalLp1501-
HidglobalLp1502 Firmware< 1.29
HidglobalLp1502-
HidglobalLp2500 Firmware< 1.29
HidglobalLp2500-
HidglobalLp4502 Firmware< 1.29
HidglobalLp4502-
HidglobalEp4502 Firmware< 1.29
HidglobalEp4502-
CarrierLenels2 Lnl-4420 Firmware< 1.29
CarrierLenels2 Lnl-4420-
CarrierLenels2 Lnl-X2210 Firmware< 1.29
CarrierLenels2 Lnl-X2210-
CarrierLenels2 Lnl-X2220 Firmware< 1.29
CarrierLenels2 Lnl-X2220-
CarrierLenels2 Lnl-X3300 Firmware< 1.29
CarrierLenels2 Lnl-X3300-
CarrierLenels2 Lnl-X4420 Firmware< 1.29
CarrierLenels2 Lnl-X4420-

Related Weaknesses (CWE)

CWE-120

References

FAQ

What is CVE-2022-31482?

CVE-2022-31482 is a vulnerability with a CVSS score of 7.5 (HIGH). An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Con...

How severe is CVE-2022-31482?

CVE-2022-31482 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-31482?

Check the references section above for vendor advisories and patch information. Affected products include: Hidglobal Lp1501 Firmware, Hidglobal Lp1501, Hidglobal Lp1502 Firmware, Hidglobal Lp1502, Hidglobal Lp2500 Firmware.