CVE-2022-31482

An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The overflowed data leads to segmentation fault and ultimately a denial-of-service condition, causing the device to reboot. The impact of this vulnerability is that an unauthenticated attacker could leverage this flaw to cause the target device to become unresponsive. An attacker could automate this attack to achieve persistent DoS, effectively rendering the target controller useless.

• CWE-120
• CWE-120

• https://www.corporate.carrier.com/product-security/advisories-resources/Vendor Advisory
• https://www.corporate.carrier.com/product-security/advisories-resources/Vendor Advisory

Published

Jun 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31477Improper initialization for some Intel(R) NUC BIOS firmware …4.4
• CVE-2022-31478The UserTakeOver plugin before 4.0.1 for ILIAS allows an att…4.3
• CVE-2022-31479An unauthenticated attacker can update the hostname with a s…9.8
• CVE-2022-3148Cross-site Scripting (XSS) - Generic in GitHub repository jg…6.1
• CVE-2022-31480An unauthenticated attacker could arbitrarily upload firmwar…7.5
• CVE-2022-31481An unauthenticated attacker can send a specially crafted upd…10
• CVE-2022-31483An authenticated attacker can upload a file with a filename …8.8
• CVE-2022-31484An unauthenticated attacker can send a specially crafted net…7.5
• CVE-2022-31485An unauthenticated attacker can send a specially crafted pac…5.3
• CVE-2022-31486An authenticated attacker can send a specially crafted route…8.8
• CVE-2022-31487Inout Blockchain AltExchanger 1.2.1 and Inout Blockchain Fia…7.5
• CVE-2022-31488Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/u…7.5