CVE-2022-31479

An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable. The injected commands only get executed during start up or when unsafe calls regarding the hostname are used. This allows the attacker to gain remote access to the device and can make their persistence permanent by modifying the filesystem.

• CWE-693
• CWE-78

• https://www.corporate.carrier.com/product-security/advisories-resources/Vendor Advisory
• https://www.corporate.carrier.com/product-security/advisories-resources/Vendor Advisory

Published

Jun 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31473In BIG-IP Versions 16.1.x before 16.1.1 and 15.1.x before 15…7.7
• CVE-2022-31474Improper Limitation of a Pathname to a Restricted Directory …7.5
• CVE-2022-31475Authenticated (custom plugin role) Arbitrary File Read via E…4.9
• CVE-2022-31476Improper access control in the Intel(R) SUR software before …5.5
• CVE-2022-31477Improper initialization for some Intel(R) NUC BIOS firmware …4.4
• CVE-2022-31478The UserTakeOver plugin before 4.0.1 for ILIAS allows an att…4.3
• CVE-2022-3148Cross-site Scripting (XSS) - Generic in GitHub repository jg…6.1
• CVE-2022-31480An unauthenticated attacker could arbitrarily upload firmwar…7.5
• CVE-2022-31481An unauthenticated attacker can send a specially crafted upd…10
• CVE-2022-31482An unauthenticated attacker can send a specially crafted una…7.5
• CVE-2022-31483An authenticated attacker can upload a file with a filename …8.8
• CVE-2022-31484An unauthenticated attacker can send a specially crafted net…7.5