Cyber Resilience

CVE-2022-31486

HighRCE

Published: 06 June 2022

Published
06 June 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0098 77.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-31486 is a high-severity OS Command Injection (CWE-78) vulnerability in Hidglobal Lp1501 Firmware. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 22.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior…

more

to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

hidglobal
lp1501 firmware
≤ 1.303
hidglobal
lp1502 firmware
≤ 1.303
hidglobal
lp2500 firmware
≤ 1.303
hidglobal
lp4502 firmware
≤ 1.303
hidglobal
ep4502 firmware
≤ 1.297
carrier
lenels2 lnl-4420 firmware
≤ 1.297
carrier
lenels2 lnl-x2210 firmware
≤ 1.303
carrier
lenels2 lnl-x2220 firmware
≤ 1.303
carrier
lenels2 lnl-x3300 firmware
≤ 1.303
carrier
lenels2 lnl-x4420 firmware
≤ 1.303
+4 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References