Skip to content
Fencer Intel
critical 9.6

CVE-2022-31479 json

Remote Code Execution via command injection of the hostname

published 4y ago modified 4mo ago also EUVD-2022-52939

cvss
9.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable. The injected commands only get executed during start up or when unsafe calls regarding the hostname are used. This allows the attacker to gain remote access to the device and can make their persistence permanent by modifying the filesystem.

Patch / fix

  • LenelS2 LNL-X2210 1.302
  • LenelS2 LNL-X2220 1.302
  • LenelS2 LNL-X3300 1.302
  • LenelS2 LNL-X4420 1.302
  • LenelS2 LNL-4420 1.296
  • LenelS2 S2-LP-1501 1.302
  • LenelS2 S2-LP-1502 1.302
  • LenelS2 S2-LP-2500 1.302
  • LenelS2 S2-LP-4502 1.302
  • HID Mercury LP1501 1.302
  • HID Mercury LP1502 1.302
  • HID Mercury LP2500 1.302
  • HID Mercury LP4502 1.302
  • HID Mercury EP4502 1.296

Is CVE-2022-31479 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-153-01 updated cvss 9.6

Carrier LenelS2 HID Mercury access panels

  • Carrier LenelS2 HID Mercury access panels sold by LenelS2 LNL-X2210, LNL-X2220, LNL-X3300, LNL-X4420
    affected: mitigation “Carrier recommends updating these access panels to the most current released firmware via the LenelS2 Partner Center. Please contact a Carrier support channel partner for instructions.” corporate.carrier.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

2.44% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • LenelS2 LNL-X2210
  • LenelS2 LNL-X2220
  • LenelS2 LNL-X3300
  • LenelS2 LNL-X4420
  • LenelS2 LNL-4420
  • LenelS2 S2-LP-1501
  • LenelS2 S2-LP-1502
  • LenelS2 S2-LP-2500
  • LenelS2 S2-LP-4502
  • HID Mercury LP1501
  • HID Mercury LP1502
  • HID Mercury LP2500
  • HID Mercury LP4502
  • HID Mercury EP4502

Classification

Weakness
  • CWE-693 Protection Mechanism Failure
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.