RCE in Carrier Lenels2 Lnl-4420
CVE-2022-31479
An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable. The injected commands only get executed during start up or when unsafe calls regarding the hostname are used. This allows the attacker to gain remote access to the device and can make their persistence permanent by modifying the filesystem.
EPSS: 0.023 (81.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- productsecurity@carrier.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-31479?
- CVE-2022-31479 is a critical-severity vulnerability in Carrier Lenels2 Lnl-4420, classified under Protection Mechanism Failure. CVSS score: 9.6/10. Published 2022-06-06.
- How severe is CVE-2022-31479?
- Critical severity. CVSS v3 base score is 9.6 out of 10.
- Is CVE-2022-31479 known to be exploited?
- 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.