PT-2022-2803 · Hid · Hid Mercury Intelligent Controllers

Published 2022-05-23 · Updated 2022-06-17 · CVE-2022-31483

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 versions prior to 1.271

Description The issue is related to incorrect restriction of directory path names, allowing an authenticated attacker to upload files with names including ".." and "/" to any location on the filesystem. This can enable a malicious actor to overwrite sensitive system files and install a startup service, gaining remote access to the underlying Linux operating system with root privileges. The vulnerability can be exploited by sending a specially crafted HTTP request.

Recommendations For versions prior to 1.271, update the firmware to version 1.271 or later to resolve the issue. As a temporary workaround, consider restricting access to file upload functionality until a patch is available. Avoid using the file upload feature with filenames including ".." and "/" until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-03335

CVE-2022-31483

Affected Products

Hid Mercury Intelligent Controllers

References · 10

• https://corporate.carrier.com/product-security/advisories-resources · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03335 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-31483 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31483 · Vendor Advisory
• https://t.me/true_secator/3049 · Telegram Post
• https://t.me/cibsecurity/43861 · Telegram Post
• https://vuldb.com/?id.201308 · Note
• https://corporate.carrier.com/Images/CARR-PSA-HID-Mercury-Vulnerabilities-006-0622_tcm558-170514.pdf · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-153-01 · Note
• https://cybersecurity-help.cz/vdb/SB2022060319 · Note