Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2022-31483

Arbitrary file write via authenticated OSDP file upload

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Carrier

Description

An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.271. This allows a malicious actor to overwrite sensitive system files and install a startup service to gain remote access to the underlaying Linux operating system with root privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

LenelS2 LNL-X2210

  • ALL to < 1.271affected

LenelS2 LNL-X2220

  • ALL to < 1.271affected

LenelS2 LNL-X3300

  • ALL to < 1.271affected

LenelS2 LNL-X4420

  • ALL to < 1.271affected

LenelS2 LNL-4420

  • ALL to < 1.271affected

LenelS2 S2-LP-1501

  • ALL to < 1.271affected

LenelS2 S2-LP-1502

  • ALL to < 1.271affected

LenelS2 S2-LP-2500

  • ALL to < 1.271affected

LenelS2 S2-LP-4502

  • ALL to < 1.271affected

HID Mercury LP1501

  • ALL to < 1.271affected

HID Mercury LP1502

  • ALL to < 1.271affected

HID Mercury LP2500

  • ALL to < 1.271affected

HID Mercury LP4502

  • ALL to < 1.271affected

HID Mercury EP4502

  • ALL to < 1.271affected

References