CVE-2022-31479 : Exploit Details and Defense Strategies

An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable. The injected commands only get executed during start up or when unsafe calls regarding the hostname are used. This allows the attacker to gain remote access to the device and can make their persistence permanent by modifying the filesystem.

Understanding CVE-2022-31479

CVE-2022-31479 is a critical vulnerability that allows unauthenticated attackers to execute shell commands via the update of the hostname in vulnerable devices. The exploitation of this vulnerability can lead to unauthorized access and control over the affected system.

What is CVE-2022-31479?

CVE-2022-31479 is a security flaw that enables remote code execution through command injection by manipulating the device's hostname. Devices running firmware versions lower than 1.302 for LP series and 1.296 for EP series of HID Mercury Intelligent Controllers are susceptible to this attack.

The Impact of CVE-2022-31479

The impact of CVE-2022-31479 is severe, with a base score of 9.6 out of 10. Attackers can compromise confidentiality, integrity, and availability of the affected systems. The vulnerability allows for unauthorized monitoring, modification of device settings, and potential system instability.

Technical Details of CVE-2022-31479

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability arises from the mishandling of input related to hostname updates, enabling attackers to inject malicious commands during system startup or unsafe hostname calls. Successful exploitation grants the attacker remote access and persistent control over the target device.

Affected Systems and Versions

Products from LenelS2 and HID Mercury, including various controller models, are impacted. Devices running firmware versions less than 1.302 for LP series and 1.296 for EP series are vulnerable to this attack.

Exploitation Mechanism

An unauthenticated attacker can exploit the vulnerability by manipulating the device's hostname with specially crafted strings that execute shell commands during core processes, granting unauthorized access and control.

Mitigation and Prevention

Protecting systems from CVE-2022-31479 requires immediate action and long-term security practices.

Immediate Steps to Take

Update the affected devices to the latest firmware version to mitigate the vulnerability.
Disable the controller's Web Server to prevent remote login and access to the web interface.

Long-Term Security Practices

Regularly monitor and apply security patches to the devices to stay protected against emerging threats.

Patching and Updates

Ensure timely installation of firmware updates and security patches provided by the vendors to address known vulnerabilities and enhance system security.