CVE-2022-31483 is a path traversal vulnerability affecting HID Mercury Intelligent Controllers (LP1501, LP1502, LP2500, LP4502, EP4502) with firmware versions prior to 1.271. An authenticated attacker can exploit this by uploading a file with a specially crafted filename containing ".." and "/" to write arbitrary files to the filesystem. This vulnerability carries a high CVSS score of 8.8, indicating a low-complexity attack that can lead to complete compromise of confidentiality, integrity, and availability, including root-level remote access to the underlying Linux OS. While there is no public exploit code (Metasploit, Nuclei, ExploitDB) and it's not on CISA's KEV catalog, it has garnered some community discussion and media coverage, suggesting awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.271CPE matchmatch criteria | cpe:2.3:o:hidglobal:lp1501_firmware:*:*:*:*:*:*:*:* | ||
< 1.271CPE matchmatch criteria | cpe:2.3:o:hidglobal:lp1502_firmware:*:*:*:*:*:*:*:* | ||
< 1.271CPE matchmatch criteria | cpe:2.3:o:hidglobal:lp2500_firmware:*:*:*:*:*:*:*:* | ||
< 1.271CPE matchmatch criteria | cpe:2.3:o:hidglobal:lp4502_firmware:*:*:*:*:*:*:*:* | ||
< 1.271CPE matchmatch criteria | cpe:2.3:o:hidglobal:ep4502_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.