Threat Investigation
Request a demo

CVE-2022-31479

Critical

Description

An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable. The injected commands only get executed during start up or when unsafe calls regarding the hostname are used. This allows the attacker to gain remote access to the device and can make their persistence permanent by modifying the filesystem.

SeverityCritical
CVSS9.6
Exploit probability—
ProductHidglobal Lp1501 Firmware
PublishedJun 6, 2022
First seenJun 6, 2022
Weakness typeCWE-693CWE-693

How to fix

Update
  • hidglobal lp1501_firmware1.302 or later
  • hidglobal lp1502_firmware1.302 or later
  • hidglobal lp2500_firmware1.302 or later
  • hidglobal lp4502_firmware1.302 or later
  • hidglobal ep4502_firmware1.296 or later
  • carrier lenels2_lnl-4420_firmware1.296 or later
  • carrier lenels2_lnl-x2210_firmware1.302 or later
  • carrier lenels2_lnl-x2220_firmware1.302 or later
  • carrier lenels2_lnl-x3300_firmware1.302 or later
  • carrier lenels2_lnl-x4420_firmware1.302 or later
  • carrier lenels2_s2-lp-1501_firmware1.302 or later
  • carrier lenels2_s2-lp-1502_firmware1.302 or later

Affected products

ProductAffected versionsFixed in
hidglobal lp1501_firmwarev < 1.3021.302
hidglobal lp1502_firmwarev < 1.3021.302
hidglobal lp2500_firmwarev < 1.3021.302
hidglobal lp4502_firmwarev < 1.3021.302
hidglobal ep4502_firmwarev < 1.2961.296
carrier lenels2_lnl-4420_firmwarev < 1.2961.296
carrier lenels2_lnl-x2210_firmwarev < 1.3021.302
carrier lenels2_lnl-x2220_firmwarev < 1.3021.302
carrier lenels2_lnl-x3300_firmwarev < 1.3021.302
carrier lenels2_lnl-x4420_firmwarev < 1.3021.302
carrier lenels2_s2-lp-1501_firmwarev < 1.3021.302
carrier lenels2_s2-lp-1502_firmwarev < 1.3021.302
carrier lenels2_s2-lp-2500_firmwarev < 1.3021.302
carrier lenels2_s2-lp-4502_firmwarev < 1.3021.302

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.