An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The impact of this vulnerability is that an unauthenticated attacker could restrict access to the web interface to legitimate users and potentially requiring them to use the default user dip switch procedure to gain access back.
Un atacante no autenticado puede enviar un paquete de red especialmente diseñado para eliminar un usuario de la interfaz web. Esta vulnerabilidad afecta a los productos basados en los controladores inteligentes HID Mercury LP1501, LP1502, LP2500, LP4502 y EP4502 que contienen versiones de firmware anteriores a 1.29. El impacto de esta vulnerabilidad es que un atacante no autenticado podría restringir el acceso a la interfaz web a usuarios legítimos y, potencialmente, requerirles que usen el procedimiento de cambio de usuario por defecto para recuperar el acceso
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:N/I:N/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-425
|
| [email protected] | Primary |
en
CWE-425
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| hidglobal | lp1501_firmware | * | <built-in method update of dict object at 0x7763bb73af80> | Operating System |
| hidglobal | lp1502_firmware | * | <built-in method update of dict object at 0x77636c7cab80> | Operating System |
| hidglobal | lp2500_firmware | * | <built-in method update of dict object at 0x77636c7c8300> | Operating System |
| hidglobal | lp4502_firmware | * | <built-in method update of dict object at 0x77636c7c95c0> | Operating System |
| hidglobal | ep4502_firmware | * | <built-in method update of dict object at 0x7763d8b88300> | Operating System |
| carrier | lenels2_lnl-4420_firmware | * | <built-in method update of dict object at 0x7763a1126280> | Operating System |
| carrier | lenels2_lnl-x2210_firmware | * | <built-in method update of dict object at 0x77636c7c8f80> | Operating System |
| carrier | lenels2_lnl-x2220_firmware | * | <built-in method update of dict object at 0x77636c7c9380> | Operating System |
| carrier | lenels2_lnl-x3300_firmware | * | <built-in method update of dict object at 0x77636c7ca0c0> | Operating System |
| carrier | lenels2_lnl-x4420_firmware | * | <built-in method update of dict object at 0x7763d8b89e00> | Operating System |
| carrier | lenels2_s2-lp-1501_firmware | * | <built-in method update of dict object at 0x77636c7cb140> | Operating System |
| carrier | lenels2_s2-lp-1502_firmware | * | <built-in method update of dict object at 0x7763a1127ac0> | Operating System |
| carrier | lenels2_s2-lp-2500_firmware | * | <built-in method update of dict object at 0x7763bb2cb1c0> | Operating System |
| carrier | lenels2_s2-lp-4502_firmware | * | <built-in method update of dict object at 0x7763d8d04440> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:hidglobal:lp1501_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:hidglobal:lp1501:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:hidglobal:lp1502_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:hidglobal:lp1502:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:hidglobal:lp2500_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:hidglobal:lp2500:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:hidglobal:lp4502_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:hidglobal:lp4502:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:hidglobal:ep4502_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:hidglobal:ep4502:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:carrier:lenels2_lnl-4420_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:carrier:lenels2_lnl-4420:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:carrier:lenels2_lnl-x2210_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:carrier:lenels2_lnl-x2210:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:carrier:lenels2_lnl-x2220_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:carrier:lenels2_lnl-x2220:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:carrier:lenels2_lnl-x3300_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:carrier:lenels2_lnl-x3300:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:carrier:lenels2_lnl-x4420_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:carrier:lenels2_lnl-x4420:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:carrier:lenels2_s2-lp-1501_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:carrier:lenels2_s2-lp-1501:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:carrier:lenels2_s2-lp-1502_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:carrier:lenels2_s2-lp-1502:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:carrier:lenels2_s2-lp-2500_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:carrier:lenels2_s2-lp-2500:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:carrier:lenels2_s2-lp-4502_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:carrier:lenels2_s2-lp-4502:-:*:*:*:*:*:*:* |