CVE-2022-31482: falha de alta gravidade em HID Mercury LP1501
Denial-of-Service via internal structure overflow
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 1.1%
An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The overflowed data leads to segmentation fault and ultimately a denial-of-service condition, causing the device to reboot. The impact of this vulnerability is that an unauthenticated attacker could leverage this flaw to cause the target device to become unresponsive. An attacker could automate this attack to achieve persistent DoS, effectively rendering the target controller useless.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
HID Mercury · EP4502HID Mercury · LP1501HID Mercury · LP1502HID Mercury · LP2500HID Mercury · LP4502LenelS2 · LNL-4420LenelS2 · LNL-X2210LenelS2 · LNL-X2220LenelS2 · LNL-X3300LenelS2 · LNL-X4420LenelS2 · S2-LP-1501LenelS2 · S2-LP-1502LenelS2 · S2-LP-2500LenelS2 · S2-LP-4502CVEs relacionadas — HID Mercury LP1501
No mesmo produto, das mais perigosas para as menos.
CVE-2022-31479CRITICALRemote Code Execution via command injection of the hostnameEPSS 2.4%CVE-2022-31483CRITICALArbitrary file write via authenticated OSDP file uploadEPSS 1.8%CVE-2022-31481CRITICALRemote Code Execution via buffer overflow in firmware update processEPSS 1.6%CVE-2022-31486HIGHCommand injection via Advanced Networking route add functionalityEPSS 1.4%CVE-2022-31484HIGHUser Account Deletion UnauthenticatedEPSS 1.1%CVE-2022-31480HIGHUnauthenticated Firmware Upload and Arbitrary RebootEPSS 1.0%