1. Home
  2. CVE Database
  3. CVE-2022-31483
CRITICAL · 9.1

CVE-2022-31483

An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products bas...

Vulnerability Description

An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.271. This allows a malicious actor to overwrite sensitive system files and install a startup service to gain remote access to the underlaying Linux operating system with root privileges.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
HidglobalLp1501 Firmware< 1.271
HidglobalLp1501-
HidglobalLp1502 Firmware< 1.271
HidglobalLp1502-
HidglobalLp2500 Firmware< 1.271
HidglobalLp2500-
HidglobalLp4502 Firmware< 1.271
HidglobalLp4502-
HidglobalEp4502 Firmware< 1.271
HidglobalEp4502-
CarrierLenels2 Lnl-4420 Firmware< 1.271
CarrierLenels2 Lnl-4420-
CarrierLenels2 Lnl-X2210 Firmware< 1.271
CarrierLenels2 Lnl-X2210-
CarrierLenels2 Lnl-X2220 Firmware< 1.271
CarrierLenels2 Lnl-X2220-
CarrierLenels2 Lnl-X3300 Firmware< 1.271
CarrierLenels2 Lnl-X3300-
CarrierLenels2 Lnl-X4420 Firmware< 1.271
CarrierLenels2 Lnl-X4420-

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2022-31483?

CVE-2022-31483 is a vulnerability with a CVSS score of 9.1 (CRITICAL). An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products bas...

How severe is CVE-2022-31483?

CVE-2022-31483 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-31483?

Check the references section above for vendor advisories and patch information. Affected products include: Hidglobal Lp1501 Firmware, Hidglobal Lp1501, Hidglobal Lp1502 Firmware, Hidglobal Lp1502, Hidglobal Lp2500 Firmware.