CVE-2022-31483 : Security Advisory and Response
Learn about CVE-2022-31483, an arbitrary file write vulnerability affecting HID Mercury Intelligent Controllers with firmware versions prior to 1.271. Take immediate steps to secure your system and prevent unauthorized access.
An authenticated attacker can exploit an arbitrary file write vulnerability via authenticated OSDP file upload to upload files with malicious filenames, resulting in system compromise. This impacts products based on HID Mercury Intelligent Controllers with firmware versions prior to 1.271, allowing attackers to gain remote access with root privileges.
Understanding CVE-2022-31483
This CVE details a critical vulnerability that allows authenticated attackers to upload files with malicious filenames to achieve unauthorized access.
What is CVE-2022-31483?
CVE-2022-31483 is an arbitrary file write vulnerability that affects products based on HID Mercury Intelligent Controllers with firmware versions less than 1.271.
The Impact of CVE-2022-31483
The vulnerability enables malicious actors to overwrite critical system files and establish a startup service, leading to remote access to the underlying Linux OS with elevated privileges.
Technical Details of CVE-2022-31483
This section covers the specifics of the vulnerability, including affected systems, exploitation mechanisms, and more.
Vulnerability Description
An authenticated attacker can manipulate filenames to upload files to any location on the filesystem, compromising the system's integrity.
Affected Systems and Versions
Products impacted include HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 with firmware versions less than 1.271.
Exploitation Mechanism
Attackers can leverage the vulnerability to overwrite critical system files and implant a startup service, granting unauthorized access to the Linux operating system.
Mitigation and Prevention
Learn about the steps to mitigate the CVE-2022-31483 vulnerability and prevent potential exploits.
Immediate Steps to Take
Disable the controller's Web Server to prevent remote login and unauthorized access. Follow the steps provided to secure your system.
Long-Term Security Practices
Regularly update firmware to the latest version and implement robust security measures to safeguard against future threats.
Patching and Updates
Update to the newest version of the firmware as a preventive measure to mitigate the vulnerability.