CVE-2022-31481

Remote Code Execution via buffer overflow in firmware update process

State: Published
Severity: 10.0 Critical
Published: Jun 6, 2022
Updated: Sep 16, 2024
Reserved: May 23, 2022

Description

An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The overflowed data can allow the attacker to manipulate the “normal” code execution to that of their choosing. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	Carrier

Weaknesses

CWE-120 Buffer Overflow

Affected Products

Product	Versions
LNL-X2210LenelS2	ALL to before 1.302Affected
LNL-X2220LenelS2	ALL to before 1.302Affected
LNL-X3300LenelS2	ALL to before 1.302Affected
LNL-X4420LenelS2	ALL to before 1.302Affected
LNL-4420LenelS2	ALL to before 1.296Affected
S2-LP-1501LenelS2	ALL to before 1.302Affected
S2-LP-1502LenelS2	ALL to before 1.302Affected
S2-LP-2500LenelS2	ALL to before 1.302Affected
S2-LP-4502LenelS2	ALL to before 1.302Affected
LP1501HID Mercury	ALL to before 1.302Affected
LP1502HID Mercury	ALL to before 1.302Affected
LP2500HID Mercury	ALL to before 1.302Affected
LP4502HID Mercury	ALL to before 1.302Affected
EP4502HID Mercury	ALL to before 1.296Affected

References

https://www.corporate.carrier.com/product-security/advisories-resources/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.