What is CVE-2022-31486?

CVE-2022-31486 is a high-severity vulnerability in Carrier Lenels2 Lnl-4420, classified under OS Command Injection. CVSS score: 8.8/10. Published 2022-06-06.

How severe is CVE-2022-31486?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Carrier Lenels2 Lnl-4420

CVE-2022-31486

An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.012 (66.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

productsecurity@carrier.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-31486?: CVE-2022-31486 is a high-severity vulnerability in Carrier Lenels2 Lnl-4420, classified under OS Command Injection. CVSS score: 8.8/10. Published 2022-06-06.
How severe is CVE-2022-31486?: High severity. CVSS v3 base score is 8.8 out of 10.