CVE-2022-31480highCWE-425

CVE-2022-31480: falha de alta gravidade em HID Mercury LP1501

Unauthenticated Firmware Upload and Arbitrary Reboot

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar EP4502+ Monitorar LP1501

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 1.0%
An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The attacker needs to have a properly signed and encrypted binary, loading the firmware to the device ultimately triggers a reboot.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
HID Mercury · EP4502HID Mercury · LP1501HID Mercury · LP1502HID Mercury · LP2500HID Mercury · LP4502LenelS2 · LNL-4420LenelS2 · LNL-X2210LenelS2 · LNL-X2220LenelS2 · LNL-X3300LenelS2 · LNL-X4420LenelS2 · S2-LP-1501LenelS2 · S2-LP-1502LenelS2 · S2-LP-2500LenelS2 · S2-LP-4502
CVEs relacionadas — HID Mercury LP1501

No mesmo produto, das mais perigosas para as menos.

CVE-2022-31479CRITICALRemote Code Execution via command injection of the hostnameEPSS 2.4%CVE-2022-31483CRITICALArbitrary file write via authenticated OSDP file uploadEPSS 1.8%CVE-2022-31481CRITICALRemote Code Execution via buffer overflow in firmware update processEPSS 1.6%CVE-2022-31486HIGHCommand injection via Advanced Networking route add functionalityEPSS 1.4%CVE-2022-31484HIGHUser Account Deletion UnauthenticatedEPSS 1.1%CVE-2022-31482HIGHDenial-of-Service via internal structure overflowEPSS 1.1%