Strix
26.1K

CVE-2022-31482

HIGHCVSS 7.5/10EPSS 0.97%

Last modified

CVE-2022-31482 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. EPSS estimates a 0.97% chance of exploitation in the next 30 days.

Description

An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The overflowed data leads to segmentation fault and ultimately a denial-of-service condition, causing the device to reboot. The impact of this vulnerability is that an unauthenticated attacker could leverage this flaw to cause the target device to become unresponsive. An attacker could automate this attack to achieve persistent DoS, effectively rendering the target controller useless.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
0.97%

57.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HidglobalLp1501 Firmware< 1.29
HidglobalLp1502 Firmware< 1.29
HidglobalLp2500 Firmware< 1.29
HidglobalLp4502 Firmware< 1.29
HidglobalEp4502 Firmware< 1.29
CarrierLenels2 Lnl-4420 Firmware< 1.29
CarrierLenels2 Lnl-X2210 Firmware< 1.29
CarrierLenels2 Lnl-X2220 Firmware< 1.29
CarrierLenels2 Lnl-X3300 Firmware< 1.29
CarrierLenels2 Lnl-X4420 Firmware< 1.29
CarrierLenels2 S2-Lp-1501 Firmware< 1.29
CarrierLenels2 S2-Lp-1502 Firmware< 1.29
CarrierLenels2 S2-Lp-2500 Firmware< 1.29
CarrierLenels2 S2-Lp-4502 Firmware< 1.29

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-31482?
An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The overflowed data leads to segmentation fault and ultimately a denial-of-service condition, causing the device to reboot. The impact of this vulnerability is that an unauthenticated attacker could leverage this flaw to cause the target device to become unresponsive. An attacker could automate this attack to achieve persistent DoS, effectively rendering the target controller useless.
How severe is CVE-2022-31482?
CVE-2022-31482 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.97% probability of exploitation in the next 30 days.
How do I fix CVE-2022-31482?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-31482?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST