CVE-2022-31481

An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The overflowed data can allow the attacker to manipulate the “normal” code execution to that of their choosing. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.

• CWE-120
• CWE-120

• https://www.corporate.carrier.com/product-security/advisories-resources/Vendor Advisory
• https://www.corporate.carrier.com/product-security/advisories-resources/Vendor Advisory

Published

Jun 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31476Improper access control in the Intel(R) SUR software before …5.5
• CVE-2022-31477Improper initialization for some Intel(R) NUC BIOS firmware …4.4
• CVE-2022-31478The UserTakeOver plugin before 4.0.1 for ILIAS allows an att…4.3
• CVE-2022-31479An unauthenticated attacker can update the hostname with a s…9.8
• CVE-2022-3148Cross-site Scripting (XSS) - Generic in GitHub repository jg…6.1
• CVE-2022-31480An unauthenticated attacker could arbitrarily upload firmwar…7.5
• CVE-2022-31482An unauthenticated attacker can send a specially crafted una…7.5
• CVE-2022-31483An authenticated attacker can upload a file with a filename …8.8
• CVE-2022-31484An unauthenticated attacker can send a specially crafted net…7.5
• CVE-2022-31485An unauthenticated attacker can send a specially crafted pac…5.3
• CVE-2022-31486An authenticated attacker can send a specially crafted route…8.8
• CVE-2022-31487Inout Blockchain AltExchanger 1.2.1 and Inout Blockchain Fia…7.5