CVE-2022-31479
📋 TL;DR
CVE-2022-31479 allows unauthenticated attackers to execute arbitrary shell commands by injecting malicious hostnames into HID Mercury Intelligent Controllers. This enables remote code execution, configuration modification, and persistent access. Affected devices include LP1501, LP1502, LP2500, LP4502, and EP4502 controllers with vulnerable firmware versions.
💻 Affected Systems
- HID Mercury Intelligent Controller LP1501
- HID Mercury Intelligent Controller LP1502
- HID Mercury Intelligent Controller LP2500
- HID Mercury Intelligent Controller LP4502
- HID Mercury Intelligent Controller EP4502
📦 What is this software?
Ep4502 Firmware by Hidglobal
Lp1501 Firmware by Hidglobal
Lp1502 Firmware by Hidglobal
Lp2500 Firmware by Hidglobal
Lp4502 Firmware by Hidglobal
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to monitor all communications, modify relays and configuration files, install persistent backdoors, and potentially pivot to other network systems.
Likely Case
Attacker gains remote shell access to modify device configuration, disrupt operations, and maintain persistence for future attacks.
If Mitigated
With proper network segmentation and access controls, impact limited to isolated device with no lateral movement.
🎯 Exploit Status
Exploitation requires sending specially crafted hostname updates to vulnerable devices. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: LP series: 1.302 or later; EP series: 1.296 or later
Vendor Advisory: https://www.corporate.carrier.com/product-security/advisories-resources/
Restart Required: Yes
Instructions:
1. Download firmware update from HID/Carrier support portal. 2. Backup current configuration. 3. Apply firmware update via management interface. 4. Reboot device. 5. Verify firmware version.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected controllers in separate VLAN with strict firewall rules preventing external access to management interfaces.
Access Control Lists
allImplement network ACLs to restrict which systems can communicate with controller management interfaces.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate controllers from untrusted networks
- Monitor for unusual hostname changes or unexpected configuration modifications
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH: LP series < 1.302 or EP series < 1.296 indicates vulnerability.Check Version:
Check via web interface at System > About or via SSH using vendor-specific commandsVerify Fix Applied:
Verify firmware version shows LP series >= 1.302 or EP series >= 1.296 after update.📡 Detection & Monitoring
Log Indicators:
- Unusual hostname changes
- Unexpected configuration modifications
- Multiple failed authentication attempts followed by successful configuration changes
Network Indicators:
- Unusual traffic patterns to controller management ports
- Hostname update requests from unexpected sources
SIEM Query:
source_ip IN (controller_ips) AND (event_type="configuration_change" OR event_type="hostname_update")