CVE-2022-31483 CRITICAL

Published: 2022-06-06 | Last Modified: 2024-11-21 | Status: Modified

Description

An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.271. This allows a malicious actor to overwrite sensitive system files and install a startup service to gain remote access to the underlaying Linux operating system with root privileges.

Additional Descriptions (1)

Un atacante autenticado puede cargar un archivo con un nombre de archivo que incluya ".." y "/" para lograr la capacidad de cargar el archivo deseado en cualquier lugar del sistema de archivos. Esta vulnerabilidad afecta a los productos basados en los controladores inteligentes HID Mercury LP1501, LP1502, LP2500, LP4502 y EP4502 que contienen versiones de firmware anteriores a 1.271. Esto permite a un actor malicioso sobrescribir archivos confidenciales del sistema e instalar un servicio de inicio para conseguir acceso remoto al sistema operativo Linux subyacente con privilegios de root

CVSS Metrics

Base Score: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 5.9

Base Score: 9.0 (HIGH)

AV:N/AC:L/Au:S/C:C/I:C/A:C

Access Vector	NETWORK
Access Complexity	LOW
Authentication	SINGLE
Confidentiality Impact	COMPLETE
Integrity Impact	COMPLETE
Availability Impact	COMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 10.0

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-22
[email protected]	Primary	en CWE-22

Affected Products

Vendor	Product	Version	Update	Type
hidglobal	lp1501_firmware	*	<built-in method update of dict object at 0x7763d8b7ddc0>	Operating System
hidglobal	lp1502_firmware	*	<built-in method update of dict object at 0x776355a8fbc0>	Operating System
hidglobal	lp2500_firmware	*	<built-in method update of dict object at 0x7763d87ec4c0>	Operating System
hidglobal	lp4502_firmware	*	<built-in method update of dict object at 0x7763d8b7f600>	Operating System
hidglobal	ep4502_firmware	*	<built-in method update of dict object at 0x7763d8b7da40>	Operating System
carrier	lenels2_lnl-4420_firmware	*	<built-in method update of dict object at 0x7763b0b8fd40>	Operating System
carrier	lenels2_lnl-x2210_firmware	*	<built-in method update of dict object at 0x7763d8b7f500>	Operating System
carrier	lenels2_lnl-x2220_firmware	*	<built-in method update of dict object at 0x776355a8f340>	Operating System
carrier	lenels2_lnl-x3300_firmware	*	<built-in method update of dict object at 0x776355a8d200>	Operating System
carrier	lenels2_lnl-x4420_firmware	*	<built-in method update of dict object at 0x7763d8b7dd80>	Operating System
carrier	lenels2_s2-lp-1501_firmware	*	<built-in method update of dict object at 0x7763b0b8e0c0>	Operating System
carrier	lenels2_s2-lp-1502_firmware	*	<built-in method update of dict object at 0x7763b0b8ffc0>	Operating System
carrier	lenels2_s2-lp-2500_firmware	*	<built-in method update of dict object at 0x77635d51bc00>	Operating System
carrier	lenels2_s2-lp-4502_firmware	*	<built-in method update of dict object at 0x7763b0b8fc80>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:hidglobal:lp1501_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:hidglobal:lp1501:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:hidglobal:lp1502_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:hidglobal:lp1502:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:hidglobal:lp2500_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:hidglobal:lp2500:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:hidglobal:lp4502_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:hidglobal:lp4502:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:hidglobal:ep4502_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:hidglobal:ep4502:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:carrier:lenels2_lnl-4420_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:carrier:lenels2_lnl-4420:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:carrier:lenels2_lnl-x2210_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:carrier:lenels2_lnl-x2210:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:carrier:lenels2_lnl-x2220_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:carrier:lenels2_lnl-x2220:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:carrier:lenels2_lnl-x3300_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:carrier:lenels2_lnl-x3300:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:carrier:lenels2_lnl-x4420_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:carrier:lenels2_lnl-x4420:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:carrier:lenels2_s2-lp-1501_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:carrier:lenels2_s2-lp-1501:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:carrier:lenels2_s2-lp-1502_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:carrier:lenels2_s2-lp-1502:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:carrier:lenels2_s2-lp-2500_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:carrier:lenels2_s2-lp-2500:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:carrier:lenels2_s2-lp-4502_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:carrier:lenels2_s2-lp-4502:-:::::::*`

References

https://www.corporate.carrier.com/product-security/advisories-resources/
Source: [email protected]

Vendor Advisory
https://www.corporate.carrier.com/product-security/advisories-resources/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory