Strix
26.1K

CVE-2022-31486

HIGHCVSS 8.8/10EPSS 1.25%

Last modified

CVE-2022-31486 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. EPSS estimates a 1.25% chance of exploitation in the next 30 days.

Description

An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
1.25%

65.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HidglobalLp1501 Firmware< 1.303
HidglobalLp1502 Firmware< 1.303
HidglobalLp2500 Firmware< 1.303
HidglobalLp4502 Firmware< 1.303
HidglobalEp4502 Firmware< 1.297
CarrierLenels2 Lnl-4420 Firmware< 1.297
CarrierLenels2 Lnl-X2210 Firmware< 1.303
CarrierLenels2 Lnl-X2220 Firmware< 1.303
CarrierLenels2 Lnl-X3300 Firmware< 1.303
CarrierLenels2 Lnl-X4420 Firmware< 1.303
CarrierLenels2 S2-Lp-1501 Firmware< 1.303
CarrierLenels2 S2-Lp-1502 Firmware< 1.303
CarrierLenels2 S2-Lp-2500 Firmware< 1.303
CarrierLenels2 S2-Lp-4502 Firmware< 1.303

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-31486?
An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.
How severe is CVE-2022-31486?
CVE-2022-31486 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 1.25% probability of exploitation in the next 30 days.
How do I fix CVE-2022-31486?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-31486?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST