← CVE Intelligence

CVE-2022-31480

Unauthenticated Firmware Upload and Arbitrary Reboot PUBLISHED

Description (CNA)

An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The attacker needs to have a properly signed and encrypted binary, loading the firmware to the device ultimately triggers a reboot.

Affected (CNA)

Vendor / productVersions
LenelS2 / LNL-X2210affected ALL before 1.302
LenelS2 / LNL-X2220affected ALL before 1.302
LenelS2 / LNL-X3300affected ALL before 1.302
LenelS2 / LNL-X4420affected ALL before 1.302
LenelS2 / LNL-4420affected ALL before 1.296
LenelS2 / S2-LP-1501affected ALL before 1.302
LenelS2 / S2-LP-1502affected ALL before 1.302
LenelS2 / S2-LP-2500affected ALL before 1.302
LenelS2 / S2-LP-4502affected ALL before 1.302
HID Mercury / LP1501affected ALL before 1.302
HID Mercury / LP1502affected ALL before 1.302
HID Mercury / LP2500affected ALL before 1.302
HID Mercury / LP4502affected ALL before 1.302
HID Mercury / EP4502affected ALL before 1.296

CWE

CWE-425

References

ADP enrichment

CVE

No English description supplied.