CVE-2022-31485

EUVD-2022-52945 · Published Jun 6, 2022

An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29.

Technologies

Carrier Lenels2 S2-Lp-4502 FirmwareCarrier Lenels2 Lnl-4420Carrier Lenels2 S2-Lp-1502Carrier Lenels2 Lnl-X2210Carrier Lenels2 S2-Lp-1501 FirmwareCarrier Lenels2 Lnl-4420 FirmwareCarrier Lenels2 Lnl-X2210 FirmwareCarrier Lenels2 Lnl-X3300Hidglobal Lp2500Carrier Lenels2 Lnl-X2220Carrier Lenels2 S2-Lp-2500Hidglobal Lp1502 FirmwareHidglobal Lp4502Hidglobal Lp4502 FirmwareCarrier Lenels2 Lnl-X4420Hidglobal Lp1501 FirmwareHidglobal Lp1502Carrier Lenels2 S2-Lp-1502 FirmwareHidglobal Lp1501Hidglobal Ep4502 FirmwareCarrier Lenels2 S2-Lp-4502Carrier Lenels2 Lnl-X4420 FirmwareHidglobal Ep4502Hidglobal Lp2500 FirmwareCarrier Lenels2 S2-Lp-2500 FirmwareCarrier Lenels2 S2-Lp-1501Carrier Lenels2 Lnl-X3300 FirmwareCarrier Lenels2 Lnl-X2220 Firmware

Weaknesses

CWE-425

CVSS scores

v3.15.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
v2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Discovery Impact

T1190Exploit Public-Facing Application T1083File and Directory Discovery T1565.002Transmitted Data Manipulation

References

https://www.corporate.carrier.com/product-security/advisories-resources/

Potentially impacted assets

See if this affects your attack surface