CVE-2022-31481 is a critical buffer overflow vulnerability affecting HID Mercury Intelligent Controllers (LP and EP series) with specific firmware versions. An unauthenticated attacker can exploit this by sending a specially crafted update file, leading to arbitrary code execution. This allows for full compromise of the device, enabling monitoring of communications, modification of relays, configuration changes, or device instability. With a CVSS score of 10.0, this vulnerability is highly severe due to its network-based attack vector, low complexity, and complete impact on confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code, it has garnered some community discussion and media coverage, indicating awareness of its potential.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.302CPE matchmatch criteria | cpe:2.3:o:hidglobal:lp1501_firmware:*:*:*:*:*:*:*:* | ||
< 1.302CPE matchmatch criteria | cpe:2.3:o:hidglobal:lp1502_firmware:*:*:*:*:*:*:*:* | ||
< 1.302CPE matchmatch criteria | cpe:2.3:o:hidglobal:lp2500_firmware:*:*:*:*:*:*:*:* | ||
< 1.302CPE matchmatch criteria | cpe:2.3:o:hidglobal:lp4502_firmware:*:*:*:*:*:*:*:* | ||
< 1.296CPE matchmatch criteria | cpe:2.3:o:hidglobal:ep4502_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.