Skip to content
OpenAdvisories
Critical ICSA-22-153-01 8 CVEs

Carrier LenelS2 HID Mercury access panels

Published Jun 2, 2022 · Updated Jun 2, 2022

Vendor: Carrier LenelS2 Product: HID Mercury access panels sold by LenelS2

Summary

Successful exploitation of these vulnerabilities could allow an attacker access to the device, allowing monitoring of all communications sent to and from the device, modification of onboard relays, changing of configuration files, device instability, and a denial-of-service condition.

Vulnerabilities 8

  • Critical 10.0
    CVE-2022-31481

    Remote Code Execution via buffer overflow in firmware update process

    An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware v…

    LenelS2 HID Mercury LP4502 S2-LP-1502
  • Critical 9.6
    CVE-2022-31479

    Remote Code Execution via command injection of the hostname

    An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP…

    LenelS2 HID Mercury LP4502 S2-LP-1502
  • Critical 9.1
    CVE-2022-31483

    Arbitrary file write via authenticated OSDP file upload

    An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, L…

    LenelS2 HID Mercury LP4502 S2-LP-1502
  • High 8.8
    CVE-2022-31486

    Command injection via Advanced Networking route add functionality

    An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which c…

    LenelS2 HID Mercury LP4502 S2-LP-1502
  • High 7.5
    CVE-2022-31480

    Unauthenticated Firmware Upload and Arbitrary Reboot

    An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502…

    LenelS2 HID Mercury LP4502 S2-LP-1502
  • High 7.5
    CVE-2022-31482

    Denial-of-Service via internal structure overflow

    An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which c…

    LenelS2 HID Mercury LP4502 S2-LP-1502
  • High 7.5
    CVE-2022-31484

    User Account Deletion Unauthenticated

    An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware…

    LenelS2 HID Mercury LP4502 S2-LP-1502
  • Medium 5.3
    CVE-2022-31485

    Unauthenticated homepage note modification

    An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 w…

    LenelS2 HID Mercury LP4502 S2-LP-1502

Revision history

  1. #1

    ICSA-22-153-01 Carrier LenelS2 HID Mercury access panels

References