CVE-2022-31485 MEDIUM

CVE-2022-31485: Unauthenticated homepage note modification

Vendor Lenels2
Product LNL-X2210
Weakness CWE-425 · Forced browsing
Published June 6, 2022
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29.

Key dates

02Disclosure timeline

June 6, 2022 CVE published
September 17, 2024 Record updated