CVE-2022-31486CWE-78

Command injection via Advanced Networking route add functionality

High · published June 6, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
71.9
In the wild
Unconfirmed
What it is

An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01379 · 71.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2022-06-06T16:41Z
EPSS history
Timeline
  • 06 JUN 16:41Z
    Command injection via Advanced Networking route add functionality
    cvelistv5