Search criteria
23 vulnerabilities
CVE-2024-5540 (GCVE-0-2024-5540)
Vulnerability from cvelistv5 – Published: 2025-11-27 01:02 – Updated: 2025-11-28 19:34
VLAI?
Summary
The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a
malicious actor to compromise the client browser
.
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Automated Logic | WebCTRL |
Affected:
0 , < 8.0
(custom)
|
||
Credits
Steve Knabe from Praetorian
Inacio Santos
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5540",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-28T14:41:21.441387Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-28T19:34:17.123Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WebCTRL",
"vendor": "Automated Logic",
"versions": [
{
"lessThan": "8.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "i-Vu",
"vendor": "Carrier",
"versions": [
{
"lessThan": "8.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Steve Knabe from Praetorian"
},
{
"lang": "en",
"type": "reporter",
"value": "Inacio Santos"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a \n\nmalicious actor to compromise the client browser\n\n.\u0026nbsp;\u0026nbsp;\u003cbr\u003e"
}
],
"value": "The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a \n\nmalicious actor to compromise the client browser\n\n."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-27T01:02:48.953Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to the latest version of ALC WebCTRL or Carrier i-Vu.\u0026nbsp;\u0026nbsp;"
}
],
"value": "Upgrade to the latest version of ALC WebCTRL or Carrier i-Vu."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ALC WebCTRL Carrier i-Vu Reflected Cross-Site Scripting",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2024-5540",
"datePublished": "2025-11-27T01:02:48.953Z",
"dateReserved": "2024-05-30T17:38:50.120Z",
"dateUpdated": "2025-11-28T19:34:17.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-5539 (GCVE-0-2024-5539)
Vulnerability from cvelistv5 – Published: 2025-11-27 01:02 – Updated: 2025-11-28 19:34
VLAI?
Summary
The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the
web based building automation server.
Severity ?
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Automated Logic | WebCTRL |
Affected:
0 , ≤ 8.5
(custom)
|
||
Credits
Steve Knabe from Praetorian
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5539",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-28T14:41:22.845542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-28T19:34:22.248Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WebCTRL",
"vendor": "Automated Logic",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "i-Vu",
"vendor": "Carrier",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Steve Knabe from Praetorian"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the \n\n\u003ci\u003eweb based building automation server.\u003c/i\u003e\u003cbr\u003e"
}
],
"value": "The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the \n\nweb based building automation server."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-27T01:02:30.525Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to the latest version of ALC WebCTRL or Carrier i-Vu. \u0026nbsp;\n\n\u003cbr\u003e"
}
],
"value": "Upgrade to the latest version of ALC WebCTRL or Carrier i-Vu."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ALC WebCTRL Carrier i-Vu Access Control Bypass",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2024-5539",
"datePublished": "2025-11-27T01:02:30.525Z",
"dateReserved": "2024-05-30T17:38:43.955Z",
"dateUpdated": "2025-11-28T19:34:22.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-0657 (GCVE-0-2025-0657)
Vulnerability from cvelistv5 – Published: 2025-11-27 01:00 – Updated: 2025-11-28 19:34
VLAI?
Summary
A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver
version drv_gen5_106-01-2380, allows
malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to
return the device to network visibility.
Severity ?
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Automated Logic | WebCtrl |
Affected:
0 , ≤ 8.5
(custom)
|
||||||||||||
|
||||||||||||||
Credits
Christopher Morales Gonzalez
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-28T14:41:24.308783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-28T19:34:27.510Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WebCtrl",
"vendor": "Automated Logic",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Gen5 Controllers",
"vendor": "Automated Logic",
"versions": [
{
"lessThanOrEqual": "drv_gen5_108-04-20120",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "i-Vu",
"vendor": "Carrier",
"versions": [
{
"lessThanOrEqual": "8.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Christopher Morales Gonzalez"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cbr\u003e\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n \u003ctd\u003eA weakness in Automated Logic and Carrier i-Vu Gen5 router on driver\n version drv_gen5_106-01-2380, allows\n malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to\n return the device to network visibility.\u003c/td\u003e\n\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver\n version drv_gen5_106-01-2380, allows\n malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to\n return the device to network visibility."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129 Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-27T01:00:59.653Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThese vulnerabilities have\nbeen remediated in cumulative releases for versions 8.5, 9.0, and Gen5 driver\nversion drv_gen5_108-04-20120\nor later.\u0026nbsp;\u003c/p\u003e\n\n\n\nSupport for versions 8.0,\n7.0,6.5, 6.1, 6.0 has expired.\n\n\n\n\u003cbr\u003e"
}
],
"value": "These vulnerabilities have\nbeen remediated in cumulative releases for versions 8.5, 9.0, and Gen5 driver\nversion drv_gen5_108-04-20120\nor later.\u00a0\n\n\n\n\n\nSupport for versions 8.0,\n7.0,6.5, 6.1, 6.0 has expired."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2025-0657",
"datePublished": "2025-11-27T01:00:59.653Z",
"dateReserved": "2025-01-22T20:22:14.084Z",
"dateUpdated": "2025-11-28T19:34:27.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-0658 (GCVE-0-2025-0658)
Vulnerability from cvelistv5 – Published: 2025-11-27 01:00 – Updated: 2025-11-28 19:34
VLAI?
Summary
A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol
causes the device to crash. The device enters a fault state; after a reset,
a second packet can leave it permanently unresponsive until a manual power cycle
is performed.
Severity ?
CWE
- CWE-20 - Improper Input Validation
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Automated Logic | Zone Controllers |
Affected:
0 , < 6.06-101
(custom)
|
|||||||
|
|||||||||
Credits
Christopher Morales Gonzalez
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-28T14:41:25.816751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-28T19:34:32.627Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zone Controllers",
"vendor": "Automated Logic",
"versions": [
{
"lessThan": "6.06-101",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Zone Controllers",
"vendor": "Carrier",
"versions": [
{
"lessThan": "6.06-101",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:automated_logic:zone_controllers:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.06-101",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:carrier:zone_controllers:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.06-101",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Christopher Morales Gonzalez"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Automated Logic and Carrier\u0027s Zone Controller\u0026nbsp;via BACnet protocol\ncauses the device to crash. The device enters a fault state; after a reset,\na second packet can leave it permanently unresponsive until a manual power cycle\nis performed."
}
],
"value": "A vulnerability in Automated Logic and Carrier\u0027s Zone Controller\u00a0via BACnet protocol\ncauses the device to crash. The device enters a fault state; after a reset,\na second packet can leave it permanently unresponsive until a manual power cycle\nis performed."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-27T01:00:16.431Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"url": "https://https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix for this vulnerability has been released in\nfirmware driver version 6.06-101 and later for both Automated Logic and Carrier\nZone controllers.\u003c/p\u003e\n\n\n\n\n\n\u003cbr\u003e"
}
],
"value": "The fix for this vulnerability has been released in\nfirmware driver version 6.06-101 and later for both Automated Logic and Carrier\nZone controllers."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Automated Logic and Carrier Zone Controllers malformed packets denial of service",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2025-0658",
"datePublished": "2025-11-27T01:00:16.431Z",
"dateReserved": "2025-01-22T20:22:16.305Z",
"dateUpdated": "2025-11-28T19:34:32.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-8528 (GCVE-0-2024-8528)
Vulnerability from cvelistv5 – Published: 2025-11-19 13:18 – Updated: 2025-11-19 15:15
VLAI?
Summary
Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized.
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Automated Logic | WebCtrl |
Affected:
6.0 , ≤ 9.0
(semver)
|
||
Credits
Jaryl Low
Thuy D. Nguyen
Cynthia E. Irvine
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8528",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-19T15:13:38.562324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T15:15:57.698Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WebCtrl",
"vendor": "Automated Logic",
"versions": [
{
"lessThanOrEqual": "9.0",
"status": "affected",
"version": "6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "i-Vu",
"vendor": "Carrier",
"versions": [
{
"lessThanOrEqual": "9.0",
"status": "affected",
"version": "6.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jaryl Low"
},
{
"lang": "en",
"type": "finder",
"value": "Thuy D. Nguyen"
},
{
"lang": "en",
"type": "finder",
"value": "Cynthia E. Irvine"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized."
}
],
"value": "Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T13:18:35.293Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "These\nvulnerabilities have been remediated in cumulative releases for versions 8.0,\n8.5, and 9.0. Please be aware that WebCTRL and i-Vu versions 7.0, 6.5, and 6.1 are no longer supported. To\nsafeguard against these vulnerabilities, upgrading to the latest WebCTRL and i-Vu software is strongly recommended.\u0026nbsp;\n\n\n\n\u003cbr\u003e"
}
],
"value": "These\nvulnerabilities have been remediated in cumulative releases for versions 8.0,\n8.5, and 9.0. Please be aware that WebCTRL and i-Vu versions 7.0, 6.5, and 6.1 are no longer supported. To\nsafeguard against these vulnerabilities, upgrading to the latest WebCTRL and i-Vu software is strongly recommended."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2024-8528",
"datePublished": "2025-11-19T13:18:35.293Z",
"dateReserved": "2024-09-06T16:01:34.807Z",
"dateUpdated": "2025-11-19T15:15:57.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-8527 (GCVE-0-2024-8527)
Vulnerability from cvelistv5 – Published: 2025-11-19 13:17 – Updated: 2025-11-19 16:05
VLAI?
Summary
Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.
Severity ?
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Automated Logic | WebCtrl |
Affected:
6.0 , ≤ 9.0
(semver)
|
||
Credits
Jaryl Low
Thuy D. Nguyen
Cynthia E. Irvine
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8527",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-19T16:04:40.466031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T16:05:46.478Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WebCtrl",
"vendor": "Automated Logic",
"versions": [
{
"lessThanOrEqual": "9.0",
"status": "affected",
"version": "6.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "i-Vu",
"vendor": "Carrier",
"versions": [
{
"lessThanOrEqual": "9.0",
"status": "affected",
"version": "6.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jaryl Low"
},
{
"lang": "en",
"type": "finder",
"value": "Thuy D. Nguyen"
},
{
"lang": "en",
"type": "finder",
"value": "Cynthia E. Irvine"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions."
}
],
"value": "Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T13:17:01.911Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to the latest version of ALC WebCTRL or Carrier i-Vu. \u0026nbsp;\n\n\u003cbr\u003e"
}
],
"value": "Upgrade to the latest version of ALC WebCTRL or Carrier i-Vu."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ALC WebCTRL Carrier i-Vu Open Redirect via URL parameter",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2024-8527",
"datePublished": "2025-11-19T13:17:01.911Z",
"dateReserved": "2024-09-06T16:01:32.884Z",
"dateUpdated": "2025-11-19T16:05:46.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9495 (GCVE-0-2025-9495)
Vulnerability from cvelistv5 – Published: 2025-09-23 01:16 – Updated: 2025-09-23 13:33
VLAI?
Summary
The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device.
Severity ?
CWE
- CWE-602 - Client-Side Enforcement of Server-Side Security
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Viessmann | Vitogate 300 |
Affected:
1 , < 3.0.0.0
(date)
|
Credits
Souvik Kandar of MicroSec (microsec.io)
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9495",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-23T13:33:41.544746Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-23T13:33:47.319Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Vitogate 300",
"vendor": "Viessmann",
"versions": [
{
"lessThan": "3.0.0.0",
"status": "affected",
"version": "1",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Souvik Kandar of MicroSec (microsec.io)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser\u2019s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device.\u003cbr\u003e"
}
],
"value": "The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser\u2019s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-602",
"description": "CWE-602 Client-Side Enforcement of Server-Side Security",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-23T01:16:53.619Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"url": "https://https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eThese\nvulnerabilities have been fixed with Vitogate 300 software version 3.1.0.1. \u003c/p\u003e\n\n\u003cp\u003eCustomers\nare strongly encouraged to upgrade by downloading software version 3.1.0.1 or newer at the\n\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://connectivity.viessmann-climatesolutions.com/gb/mp-fp/vitogate/vitogate-300-bn-mb.html\"\u003eVitogate\n300 website.\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "These\nvulnerabilities have been fixed with Vitogate 300 software version 3.1.0.1. \n\n\n\nCustomers\nare strongly encouraged to upgrade by downloading software version 3.1.0.1 or newer at the\nVitogate\n300 website."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Viessmann Vitogate 300 Authentication Bypass",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2025-9495",
"datePublished": "2025-09-23T01:16:53.619Z",
"dateReserved": "2025-08-26T17:40:58.043Z",
"dateUpdated": "2025-09-23T13:33:47.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-9494 (GCVE-0-2025-9494)
Vulnerability from cvelistv5 – Published: 2025-09-23 01:12 – Updated: 2025-09-23 13:34
VLAI?
Summary
An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices.
Severity ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Viessmann | Vitogate 300 |
Affected:
1 , < 3.1.0.0
(SKU)
|
Credits
adhkr of LuwakLab working with Trend Micro Zero Day Initiative
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-23T13:33:59.911370Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-23T13:34:06.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Vitogate 300",
"vendor": "Viessmann",
"versions": [
{
"lessThan": "3.1.0.0",
"status": "affected",
"version": "1",
"versionType": "SKU"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "adhkr of LuwakLab working with Trend Micro Zero Day Initiative"
}
],
"datePublic": "2025-09-22T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices.\u003cbr\u003e"
}
],
"value": "An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-23T01:12:17.459Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThese\nvulnerabilities have been fixed with Vitogate 300 software version 3.1.0.1. \u003c/p\u003e\n\n\u003cp\u003eCustomers\nare strongly encouraged to upgrade by downloading software version 3.1.0.1 at the\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://connectivity.viessmann-climatesolutions.com/gb/mp-fp/vitogate/vitogate-300-bn-mb.html\"\u003eVitogate\n300\u0026nbsp;\u003c/a\u003ewebsite.\u003cb\u003e\u003c/b\u003e\u003c/p\u003e"
}
],
"value": "These\nvulnerabilities have been fixed with Vitogate 300 software version 3.1.0.1. \n\n\n\nCustomers\nare strongly encouraged to upgrade by downloading software version 3.1.0.1 at the\u00a0Vitogate\n300\u00a0website."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Viessmann Vitogate 300 OS Command Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2025-9494",
"datePublished": "2025-09-23T01:12:17.459Z",
"dateReserved": "2025-08-26T17:40:54.110Z",
"dateUpdated": "2025-09-23T13:34:06.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-10930 (GCVE-0-2024-10930)
Vulnerability from cvelistv5 – Published: 2025-03-04 17:21 – Updated: 2025-03-04 18:32
VLAI?
Summary
An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated privileges.
Severity ?
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Carrier | Block Load |
Affected:
4.00, 4.10-4.16
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-10930",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-04T18:32:22.141296Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-04T18:32:38.413Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Block Load",
"vendor": "Carrier",
"versions": [
{
"status": "affected",
"version": "4.00, 4.10-4.16"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated privileges."
}
],
"value": "An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-04T17:21:39.313Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerability has been fixed in Block Load version 4.2, available for download on the Carrier eDesign Program Downloads website."
}
],
"value": "The vulnerability has been fixed in Block Load version 4.2, available for download on the Carrier eDesign Program Downloads website."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Carrier Block Load Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2024-10930",
"datePublished": "2025-03-04T17:21:39.313Z",
"dateReserved": "2024-11-06T16:56:42.600Z",
"dateUpdated": "2025-03-04T18:32:38.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8525 (GCVE-0-2024-8525)
Vulnerability from cvelistv5 – Published: 2024-11-21 15:32 – Updated: 2024-11-21 17:37
VLAI?
Summary
An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file.
Severity ?
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Automated Logic, a Carrier company | WebCTRL |
Affected:
7.0
|
||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:automatedlogic:webctrl:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "webctrl",
"vendor": "automatedlogic",
"versions": [
{
"status": "affected",
"version": "7.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8525",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-21T17:34:08.034594Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T17:37:57.529Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WebCTRL",
"vendor": "Automated Logic, a Carrier company",
"versions": [
{
"status": "affected",
"version": "7.0"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "i-Vu",
"vendor": "Carrier",
"versions": [
{
"status": "affected",
"version": "7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file.\u0026nbsp;"
}
],
"value": "An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T15:32:55.593Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A software update is available on the authorized dealer support site. Although a software \nupdate is available for this issue, the last support date for v7.0 was 1/27/2023 and it is \nrecommended that customers upgrade their software to the latest supported version\n\n\u003cbr\u003e"
}
],
"value": "A software update is available on the authorized dealer support site. Although a software \nupdate is available for this issue, the last support date for v7.0 was 1/27/2023 and it is \nrecommended that customers upgrade their software to the latest supported version"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2024-8525",
"datePublished": "2024-11-21T15:32:55.593Z",
"dateReserved": "2024-09-06T16:01:29.505Z",
"dateUpdated": "2024-11-21T17:37:57.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8526 (GCVE-0-2024-8526)
Vulnerability from cvelistv5 – Published: 2024-11-21 15:29 – Updated: 2024-11-21 17:38
VLAI?
Summary
A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously
crafted URL, which when visited by an authenticated WebCTRL user, could result in the redirection
of the user to a malicious webpage via "index.jsp"
Severity ?
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Automated Logic, a Carrier company | WebCTRL |
Affected:
7.0
|
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8526",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-21T17:38:21.418183Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T17:38:33.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WebCTRL",
"vendor": "Automated Logic, a Carrier company",
"versions": [
{
"status": "affected",
"version": "7.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "i-Vu",
"vendor": "Carrier",
"versions": [
{
"status": "affected",
"version": "7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously\ncrafted URL, which when visited by an authenticated WebCTRL user, could result in the redirection\nof the user to a malicious webpage via \"index.jsp\""
}
],
"value": "A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously\ncrafted URL, which when visited by an authenticated WebCTRL user, could result in the redirection\nof the user to a malicious webpage via \"index.jsp\""
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T15:29:55.681Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue was fixed at version 8.0. It is recommended that customers upgrade their software to the latest supported version."
}
],
"value": "This issue was fixed at version 8.0. It is recommended that customers upgrade their software to the latest supported version."
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Automated Logic WebCTRL and Carrier i-Vu Open Redirect",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2024-8526",
"datePublished": "2024-11-21T15:29:55.681Z",
"dateReserved": "2024-09-06T16:01:31.447Z",
"dateUpdated": "2024-11-21T17:38:33.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-2422 (GCVE-0-2024-2422)
Vulnerability from cvelistv5 – Published: 2024-05-30 17:26 – Updated: 2024-08-01 19:11
VLAI?
Summary
LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands.
Severity ?
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Credits
Claroty Team82
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:carrier:lenels2_netbox:0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "lenels2_netbox",
"vendor": "carrier",
"versions": [
{
"lessThanOrEqual": "5.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-2422",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-30T23:15:27.680824Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:30:36.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:11:53.469Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf"
},
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NetBox",
"vendor": "LenelS2",
"versions": [
{
"lessThanOrEqual": "5.6.1",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands."
}
],
"value": "LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-30T17:26:12.543Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "LenelS2 advises customers to apply to the updated version of NetBox 5.6.2 or newer via the LenelS2 Partner Center. Please get in touch with your support channel partner for instructions."
}
],
"value": "LenelS2 advises customers to apply to the updated version of NetBox 5.6.2 or newer via the LenelS2 Partner Center. Please get in touch with your support channel partner for instructions."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "LenelS2 NetBox Improper Neutralization of Argumented Delimiters",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2024-2422",
"datePublished": "2024-05-30T17:26:12.543Z",
"dateReserved": "2024-03-13T13:55:55.979Z",
"dateUpdated": "2024-08-01T19:11:53.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-2421 (GCVE-0-2024-2421)
Vulnerability from cvelistv5 – Published: 2024-05-30 17:24 – Updated: 2024-08-01 19:11
VLAI?
Summary
LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions.
Severity ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Credits
Claroty Team82
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:carrier:lenels2_netbox:0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "lenels2_netbox",
"vendor": "carrier",
"versions": [
{
"lessThanOrEqual": "5.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-2421",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-31T16:38:35.581709Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:29:16.378Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:11:53.525Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf"
},
{
"tags": [
"government-resource",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NetBox",
"vendor": "LenelS2",
"versions": [
{
"lessThanOrEqual": "5.6.1",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions."
}
],
"value": "LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-30T17:24:33.231Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "LenelS2 advises customers to apply to the updated version of NetBox 5.6.2 or newer via the LenelS2 Partner Center. Please get in touch with your support channel partner for instructions."
}
],
"value": "LenelS2 advises customers to apply to the updated version of NetBox 5.6.2 or newer via the LenelS2 Partner Center. Please get in touch with your support channel partner for instructions."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "LenelS2 NetBox Improper Neutralization of Special Elements",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2024-2421",
"datePublished": "2024-05-30T17:24:33.231Z",
"dateReserved": "2024-03-13T13:55:51.729Z",
"dateUpdated": "2024-08-01T19:11:53.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-2420 (GCVE-0-2024-2420)
Vulnerability from cvelistv5 – Published: 2024-05-30 17:22 – Updated: 2024-08-01 19:11
VLAI?
Summary
LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements.
Severity ?
CWE
- CWE-259 - Use of Hardcoded Password
Assigner
References
Credits
Claroty Team82
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:carrier:lenels2_netbox:0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "lenels2_netbox",
"vendor": "carrier",
"versions": [
{
"lessThanOrEqual": "5.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-2420",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-30T19:12:38.190957Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:29:12.413Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:11:53.496Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NetBox",
"vendor": "LenelS2",
"versions": [
{
"lessThanOrEqual": "5.6.1",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "LenelS2 NetBox access control and event monitoring system was discovered to contain\u0026nbsp;Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements.\u0026nbsp;"
}
],
"value": "LenelS2 NetBox access control and event monitoring system was discovered to contain\u00a0Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "CWE-259 Use of Hardcoded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-30T17:22:06.344Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"url": "https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "LenelS2 advises customers to apply to the updated version of NetBox 5.6.2 or newer via the LenelS2 Partner Center. Please get in touch with your support channel partner for instructions."
}
],
"value": "LenelS2 advises customers to apply to the updated version of NetBox 5.6.2 or newer via the LenelS2 Partner Center. Please get in touch with your support channel partner for instructions."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "LenelS2 NetBox Hardcoded Credentials",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2024-2420",
"datePublished": "2024-05-30T17:22:06.344Z",
"dateReserved": "2024-03-13T13:55:47.727Z",
"dateUpdated": "2024-08-01T19:11:53.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-36483 (GCVE-0-2023-36483)
Vulnerability from cvelistv5 – Published: 2024-03-16 00:00 – Updated: 2024-08-28 16:23
VLAI?
Summary
Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and
MASmobile Classic iOS version 1.7.24 and earlier
which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history.
Severity ?
6.5 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MAS (a Carrier brand) | MASmobile Classic |
Affected:
1 , ≤ 1.16.18
(custom)
|
||||||||||||
|
||||||||||||||
Credits
Joris Talma, independent .NET developer from The Netherlands, reported this vulnerability to Carrier.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:45:57.162Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:carrier:masmobile_classic:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "masmobile_classic",
"vendor": "carrier",
"versions": [
{
"lessThanOrEqual": "1.16.18",
"status": "affected",
"version": "1",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.7.24",
"status": "affected",
"version": "1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:carrier:mas_asp.net_services:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mas_asp.net_services",
"vendor": "carrier",
"versions": [
{
"lessThanOrEqual": "1.9",
"status": "affected",
"version": "1",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-36483",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-18T15:09:34.432630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T16:23:17.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "MASmobile Classic",
"vendor": "MAS (a Carrier brand)",
"versions": [
{
"lessThanOrEqual": "1.16.18",
"status": "affected",
"version": "1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"iOS"
],
"product": "MASmobile Classic",
"vendor": "MAS (a Carrier brand)",
"versions": [
{
"lessThanOrEqual": "1.7.24",
"status": "affected",
"version": "1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MAS ASP.Net Services",
"vendor": "MAS (a Carrier brand)",
"versions": [
{
"lessThanOrEqual": "1.9",
"status": "affected",
"version": "1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Joris Talma, independent .NET developer from The Netherlands, reported this vulnerability to Carrier."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android\u0026nbsp; version 1.16.18 and earlier and \n\nMASmobile Classic iOS version 1.7.24 and earlier\n\nwhich allows remote attackers to retrieve sensitive data\u0026nbsp; including customer data, security system status, and event history.\u003cbr\u003e"
}
],
"value": "Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android\u00a0 version 1.16.18 and earlier and \n\nMASmobile Classic iOS version 1.7.24 and earlier\n\nwhich allows remote attackers to retrieve sensitive data\u00a0 including customer data, security system status, and event history.\n"
}
],
"impacts": [
{
"capecId": "CAPEC-59",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-59 Session Credential Falsification through Prediction"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-21T21:23:21.767Z",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "1. Uninstall MASmobile Classic Services - These services are installed and configured manually in IIS within a virtual directory. To uninstall, unpublish the services in IIS and remove the service files. All versions (v1.7, 1.8, and 1.9) were discontinued.\u003cbr\u003e2. Remove the MASmobile Classic app from Android and iOS devices. All versions (v1.x.x) were discontinued and no longer available in the app stores (Play and AppStore).\u003cbr\u003e3. Contact MAS to arrange the installation of MASterMind EX Services (v6.46 or later). These services do not run under IIS and must be configured in coordination with the customer.\u003cbr\u003e4. Install MASmobile app from Play or AppStore (v2.x.x). This is not an upgrade to MASmobile Classic; it is a different app."
}
],
"value": "1. Uninstall MASmobile Classic Services - These services are installed and configured manually in IIS within a virtual directory. To uninstall, unpublish the services in IIS and remove the service files. All versions (v1.7, 1.8, and 1.9) were discontinued.\n2. Remove the MASmobile Classic app from Android and iOS devices. All versions (v1.x.x) were discontinued and no longer available in the app stores (Play and AppStore).\n3. Contact MAS to arrange the installation of MASterMind EX Services (v6.46 or later). These services do not run under IIS and must be configured in coordination with the customer.\n4. Install MASmobile app from Play or AppStore (v2.x.x). This is not an upgrade to MASmobile Classic; it is a different app."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MAS (a Carrier brand) MASmobile Classic Authorization Bypass",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2023-36483",
"datePublished": "2024-03-16T00:00:00",
"dateReserved": "2023-06-22T00:00:00",
"dateUpdated": "2024-08-28T16:23:17.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-31486 (GCVE-0-2022-31486)
Vulnerability from cvelistv5 – Published: 2022-06-06 16:41 – Updated: 2024-09-16 18:03
VLAI?
Summary
An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.
Severity ?
8.8 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| LenelS2 | LNL-X2210 |
Affected:
ALL , < 1.303
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:19:06.079Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "LNL-X2210",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X2220",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X3300",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.297",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1501",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-2500",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-4502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1501",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP2500",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.303",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "EP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.297",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"datePublic": "2022-06-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An authenticated attacker can send a specially crafted route to the \u201cedit_route.cgi\u201d binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-06T16:41:46",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"title": "Command injection via Advanced Networking route add functionality",
"workarounds": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@carrier.com",
"DATE_PUBLIC": "2022-06-02T22:00:00.000Z",
"ID": "CVE-2022-31486",
"STATE": "PUBLIC",
"TITLE": "Command injection via Advanced Networking route add functionality"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "LNL-X2210",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
},
{
"product_name": "LNL-X2220",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
},
{
"product_name": "LNL-X3300",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
},
{
"product_name": "LNL-X4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
},
{
"product_name": "LNL-4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.297"
}
]
}
},
{
"product_name": "S2-LP-1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
},
{
"product_name": "S2-LP-1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
},
{
"product_name": "S2-LP-2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
},
{
"product_name": "S2-LP-4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
}
]
},
"vendor_name": "LenelS2"
},
{
"product": {
"product_data": [
{
"product_name": "LP1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
},
{
"product_name": "LP1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
},
{
"product_name": "LP2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
},
{
"product_name": "LP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.303"
}
]
}
},
{
"product_name": "EP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.297"
}
]
}
}
]
},
"vendor_name": "HID Mercury"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An authenticated attacker can send a specially crafted route to the \u201cedit_route.cgi\u201d binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.corporate.carrier.com/product-security/advisories-resources/",
"refsource": "MISC",
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2022-31486",
"datePublished": "2022-06-06T16:41:46.407824Z",
"dateReserved": "2022-05-23T00:00:00",
"dateUpdated": "2024-09-16T18:03:16.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-31485 (GCVE-0-2022-31485)
Vulnerability from cvelistv5 – Published: 2022-06-06 16:41 – Updated: 2024-09-17 00:26
VLAI?
Summary
An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29.
Severity ?
5.3 (Medium)
CWE
- CWE-425 - Direct Request (Forced Browsing)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| LenelS2 | LNL-X2210 |
Affected:
ALL , < 1.29
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:19:06.061Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "LNL-X2210",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X2220",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X3300",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1501",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-2500",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-4502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1501",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP2500",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "EP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"datePublic": "2022-06-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker can send a specially crafted packets to update the \u201cnotes\u201d section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-425",
"description": "CWE-425 Direct Request (Forced Browsing)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-06T16:41:09",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated homepage note modification",
"workarounds": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@carrier.com",
"DATE_PUBLIC": "2022-06-02T22:00:00.000Z",
"ID": "CVE-2022-31485",
"STATE": "PUBLIC",
"TITLE": "Unauthenticated homepage note modification"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "LNL-X2210",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-X2220",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-X3300",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-X4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
}
]
},
"vendor_name": "LenelS2"
},
{
"product": {
"product_data": [
{
"product_name": "LP1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LP1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LP2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "EP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
}
]
},
"vendor_name": "HID Mercury"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An unauthenticated attacker can send a specially crafted packets to update the \u201cnotes\u201d section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-425 Direct Request (Forced Browsing)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.corporate.carrier.com/product-security/advisories-resources/",
"refsource": "MISC",
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2022-31485",
"datePublished": "2022-06-06T16:41:09.100189Z",
"dateReserved": "2022-05-23T00:00:00",
"dateUpdated": "2024-09-17T00:26:24.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-31484 (GCVE-0-2022-31484)
Vulnerability from cvelistv5 – Published: 2022-06-06 16:40 – Updated: 2024-09-17 01:37
VLAI?
Summary
An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The impact of this vulnerability is that an unauthenticated attacker could restrict access to the web interface to legitimate users and potentially requiring them to use the default user dip switch procedure to gain access back.
Severity ?
7.5 (High)
CWE
- CWE-425 - Direct Request (Forced Browsing)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| LenelS2 | LNL-X2210 |
Affected:
ALL , < 1.29
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:19:06.059Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "LNL-X2210",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X2220",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X3300",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1501",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-2500",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-4502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1501",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP2500",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "EP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"datePublic": "2022-06-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The impact of this vulnerability is that an unauthenticated attacker could restrict access to the web interface to legitimate users and potentially requiring them to use the default user dip switch procedure to gain access back."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-425",
"description": "CWE-425 Direct Request (Forced Browsing)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-06T16:40:33",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"title": "User Account Deletion Unauthenticated",
"workarounds": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@carrier.com",
"DATE_PUBLIC": "2022-06-02T22:00:00.000Z",
"ID": "CVE-2022-31484",
"STATE": "PUBLIC",
"TITLE": "User Account Deletion Unauthenticated"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "LNL-X2210",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-X2220",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-X3300",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-X4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
}
]
},
"vendor_name": "LenelS2"
},
{
"product": {
"product_data": [
{
"product_name": "LP1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LP1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LP2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "EP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
}
]
},
"vendor_name": "HID Mercury"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The impact of this vulnerability is that an unauthenticated attacker could restrict access to the web interface to legitimate users and potentially requiring them to use the default user dip switch procedure to gain access back."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-425 Direct Request (Forced Browsing)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.corporate.carrier.com/product-security/advisories-resources/",
"refsource": "MISC",
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2022-31484",
"datePublished": "2022-06-06T16:40:33.983938Z",
"dateReserved": "2022-05-23T00:00:00",
"dateUpdated": "2024-09-17T01:37:06.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-31483 (GCVE-0-2022-31483)
Vulnerability from cvelistv5 – Published: 2022-06-06 16:39 – Updated: 2024-09-16 18:55
VLAI?
Summary
An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.271. This allows a malicious actor to overwrite sensitive system files and install a startup service to gain remote access to the underlaying Linux operating system with root privileges.
Severity ?
9.1 (Critical)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| LenelS2 | LNL-X2210 |
Affected:
ALL , < 1.271
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:19:06.090Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "LNL-X2210",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X2220",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X3300",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1501",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-2500",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-4502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1501",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP2500",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "EP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.271",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"datePublic": "2022-06-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An authenticated attacker can upload a file with a filename including \u201c..\u201d and \u201c/\u201d to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.271. This allows a malicious actor to overwrite sensitive system files and install a startup service to gain remote access to the underlaying Linux operating system with root privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-06T16:39:56",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"title": "Arbitrary file write via authenticated OSDP file upload",
"workarounds": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@carrier.com",
"DATE_PUBLIC": "2022-06-02T22:00:00.000Z",
"ID": "CVE-2022-31483",
"STATE": "PUBLIC",
"TITLE": "Arbitrary file write via authenticated OSDP file upload"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "LNL-X2210",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "LNL-X2220",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "LNL-X3300",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "LNL-X4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "LNL-4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "S2-LP-1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "S2-LP-1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "S2-LP-2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "S2-LP-4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
}
]
},
"vendor_name": "LenelS2"
},
{
"product": {
"product_data": [
{
"product_name": "LP1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "LP1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "LP2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "LP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
},
{
"product_name": "EP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.271"
}
]
}
}
]
},
"vendor_name": "HID Mercury"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An authenticated attacker can upload a file with a filename including \u201c..\u201d and \u201c/\u201d to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.271. This allows a malicious actor to overwrite sensitive system files and install a startup service to gain remote access to the underlaying Linux operating system with root privileges."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.corporate.carrier.com/product-security/advisories-resources/",
"refsource": "MISC",
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2022-31483",
"datePublished": "2022-06-06T16:39:56.305369Z",
"dateReserved": "2022-05-23T00:00:00",
"dateUpdated": "2024-09-16T18:55:31.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-31482 (GCVE-0-2022-31482)
Vulnerability from cvelistv5 – Published: 2022-06-06 16:39 – Updated: 2024-09-17 01:00
VLAI?
Summary
An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The overflowed data leads to segmentation fault and ultimately a denial-of-service condition, causing the device to reboot. The impact of this vulnerability is that an unauthenticated attacker could leverage this flaw to cause the target device to become unresponsive. An attacker could automate this attack to achieve persistent DoS, effectively rendering the target controller useless.
Severity ?
7.5 (High)
CWE
- CWE-120 - Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| LenelS2 | LNL-X2210 |
Affected:
ALL , < 1.29
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:19:05.847Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "LNL-X2210",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X2220",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X3300",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1501",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-2500",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-4502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1501",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP2500",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "EP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.29",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"datePublic": "2022-06-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The overflowed data leads to segmentation fault and ultimately a denial-of-service condition, causing the device to reboot. The impact of this vulnerability is that an unauthenticated attacker could leverage this flaw to cause the target device to become unresponsive. An attacker could automate this attack to achieve persistent DoS, effectively rendering the target controller useless."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-06T16:39:22",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"title": "Denial-of-Service via internal structure overflow",
"workarounds": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@carrier.com",
"DATE_PUBLIC": "2022-06-02T22:00:00.000Z",
"ID": "CVE-2022-31482",
"STATE": "PUBLIC",
"TITLE": "Denial-of-Service via internal structure overflow"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "LNL-X2210",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-X2220",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-X3300",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-X4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LNL-4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "S2-LP-4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
}
]
},
"vendor_name": "LenelS2"
},
{
"product": {
"product_data": [
{
"product_name": "LP1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LP1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LP2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "LP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
},
{
"product_name": "EP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.29"
}
]
}
}
]
},
"vendor_name": "HID Mercury"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The overflowed data leads to segmentation fault and ultimately a denial-of-service condition, causing the device to reboot. The impact of this vulnerability is that an unauthenticated attacker could leverage this flaw to cause the target device to become unresponsive. An attacker could automate this attack to achieve persistent DoS, effectively rendering the target controller useless."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-120 Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.corporate.carrier.com/product-security/advisories-resources/",
"refsource": "MISC",
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2022-31482",
"datePublished": "2022-06-06T16:39:22.500510Z",
"dateReserved": "2022-05-23T00:00:00",
"dateUpdated": "2024-09-17T01:00:48.176Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-31481 (GCVE-0-2022-31481)
Vulnerability from cvelistv5 – Published: 2022-06-06 16:38 – Updated: 2024-09-16 16:12
VLAI?
Summary
An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The overflowed data can allow the attacker to manipulate the “normal” code execution to that of their choosing. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.
Severity ?
10 (Critical)
CWE
- CWE-120 - Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| LenelS2 | LNL-X2210 |
Affected:
ALL , < 1.302
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:19:06.065Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "LNL-X2210",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X2220",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X3300",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.296",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1501",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-2500",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-4502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1501",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP2500",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "EP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.296",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"datePublic": "2022-06-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The overflowed data can allow the attacker to manipulate the \u201cnormal\u201d code execution to that of their choosing. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-06T16:38:51",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"title": "Remote Code Execution via buffer overflow in firmware update process",
"workarounds": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@carrier.com",
"DATE_PUBLIC": "2022-06-02T22:00:00.000Z",
"ID": "CVE-2022-31481",
"STATE": "PUBLIC",
"TITLE": "Remote Code Execution via buffer overflow in firmware update process"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "LNL-X2210",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-X2220",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-X3300",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-X4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.296"
}
]
}
},
{
"product_name": "S2-LP-1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "S2-LP-1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "S2-LP-2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "S2-LP-4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
}
]
},
"vendor_name": "LenelS2"
},
{
"product": {
"product_data": [
{
"product_name": "LP1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LP1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LP2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "EP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.296"
}
]
}
}
]
},
"vendor_name": "HID Mercury"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The overflowed data can allow the attacker to manipulate the \u201cnormal\u201d code execution to that of their choosing. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-120 Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.corporate.carrier.com/product-security/advisories-resources/",
"refsource": "MISC",
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2022-31481",
"datePublished": "2022-06-06T16:38:51.453086Z",
"dateReserved": "2022-05-23T00:00:00",
"dateUpdated": "2024-09-16T16:12:27.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-31480 (GCVE-0-2022-31480)
Vulnerability from cvelistv5 – Published: 2022-06-06 16:37 – Updated: 2024-09-17 01:55
VLAI?
Summary
An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The attacker needs to have a properly signed and encrypted binary, loading the firmware to the device ultimately triggers a reboot.
Severity ?
7.5 (High)
CWE
- CWE-425 - Direct Request (Forced Browsing)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| LenelS2 | LNL-X2210 |
Affected:
ALL , < 1.302
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:19:06.075Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "LNL-X2210",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X2220",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X3300",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.296",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1501",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-2500",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-4502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1501",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP2500",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "EP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.296",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"datePublic": "2022-06-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The attacker needs to have a properly signed and encrypted binary, loading the firmware to the device ultimately triggers a reboot."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-425",
"description": "CWE-425 Direct Request (Forced Browsing)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-06T16:37:36",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Firmware Upload and Arbitrary Reboot",
"workarounds": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@carrier.com",
"DATE_PUBLIC": "2022-06-02T22:00:00.000Z",
"ID": "CVE-2022-31480",
"STATE": "PUBLIC",
"TITLE": "Unauthenticated Firmware Upload and Arbitrary Reboot"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "LNL-X2210",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-X2220",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-X3300",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-X4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.296"
}
]
}
},
{
"product_name": "S2-LP-1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "S2-LP-1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "S2-LP-2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "S2-LP-4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
}
]
},
"vendor_name": "LenelS2"
},
{
"product": {
"product_data": [
{
"product_name": "LP1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LP1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LP2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "EP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.296"
}
]
}
}
]
},
"vendor_name": "HID Mercury"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The attacker needs to have a properly signed and encrypted binary, loading the firmware to the device ultimately triggers a reboot."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-425 Direct Request (Forced Browsing)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.corporate.carrier.com/product-security/advisories-resources/",
"refsource": "MISC",
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2022-31480",
"datePublished": "2022-06-06T16:37:36.175759Z",
"dateReserved": "2022-05-23T00:00:00",
"dateUpdated": "2024-09-17T01:55:48.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-31479 (GCVE-0-2022-31479)
Vulnerability from cvelistv5 – Published: 2022-06-06 16:36 – Updated: 2024-09-16 22:30
VLAI?
Summary
An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable. The injected commands only get executed during start up or when unsafe calls regarding the hostname are used. This allows the attacker to gain remote access to the device and can make their persistence permanent by modifying the filesystem.
Severity ?
9.6 (Critical)
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| LenelS2 | LNL-X2210 |
Affected:
ALL , < 1.302
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:19:05.763Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "LNL-X2210",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X2220",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X3300",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-X4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LNL-4420",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.296",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1501",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-1502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-2500",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "S2-LP-4502",
"vendor": "LenelS2",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1501",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP1502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP2500",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "LP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.302",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
},
{
"product": "EP4502",
"vendor": "HID Mercury",
"versions": [
{
"lessThan": "1.296",
"status": "affected",
"version": "ALL",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"datePublic": "2022-06-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable. The injected commands only get executed during start up or when unsafe calls regarding the hostname are used. This allows the attacker to gain remote access to the device and can make their persistence permanent by modifying the filesystem."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-06T16:36:46",
"orgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"shortName": "Carrier"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"title": "Remote Code Execution via command injection of the hostname",
"workarounds": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@carrier.com",
"DATE_PUBLIC": "2022-06-02T22:00:00.000Z",
"ID": "CVE-2022-31479",
"STATE": "PUBLIC",
"TITLE": "Remote Code Execution via command injection of the hostname"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "LNL-X2210",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-X2220",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-X3300",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-X4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LNL-4420",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.296"
}
]
}
},
{
"product_name": "S2-LP-1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "S2-LP-1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "S2-LP-2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "S2-LP-4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
}
]
},
"vendor_name": "LenelS2"
},
{
"product": {
"product_data": [
{
"product_name": "LP1501",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LP1502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LP2500",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "LP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.302"
}
]
}
},
{
"product_name": "EP4502",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "ALL",
"version_value": "1.296"
}
]
}
}
]
},
"vendor_name": "HID Mercury"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable. The injected commands only get executed during start up or when unsafe calls regarding the hostname are used. This allows the attacker to gain remote access to the device and can make their persistence permanent by modifying the filesystem."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-693 Protection Mechanism Failure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.corporate.carrier.com/product-security/advisories-resources/",
"refsource": "MISC",
"url": "https://www.corporate.carrier.com/product-security/advisories-resources/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to the latest version of firmware"
}
],
"source": {
"advisory": "CARR-PSA-006-0522",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Disable the controller\u0027s Web Server. \nWhen the controller is configured to disable web access, you cannot remotely login into the controller\u2019s web page.\n1. Login to controller web pages\n2. Go to \u201cUsers\u201d Tab\n3. Near bottom of the Users page, check option to \u201cDisable Web Server\u201d\n4. Then select \u201cSubmit\u201d at the bottom of the page\n5. Then select \u201cApply Settings\u201d tab\n6. And on that page, select button \u201cApply Settings, Reboot\u201d\nThe Controller will apply the new setting and reboot. Web login will be disabled until switch 1 is physically turned ON, on the controller."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "e24e6442-3ae1-4538-a7b8-7ac95586db8f",
"assignerShortName": "Carrier",
"cveId": "CVE-2022-31479",
"datePublished": "2022-06-06T16:36:46.116844Z",
"dateReserved": "2022-05-23T00:00:00",
"dateUpdated": "2024-09-16T22:30:23.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}