Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2022-31483 |
CWE-ID | CWE-22 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
LNL-X2210 Hardware solutions / Firmware LNL-X2220 Hardware solutions / Firmware LNL-X3300 Hardware solutions / Firmware LNL-X4420 Hardware solutions / Firmware LNL-4420 Hardware solutions / Firmware S2-LP-1501 Hardware solutions / Firmware S2-LP-4502 Hardware solutions / Firmware S2-LP-2500 Hardware solutions / Firmware S2-LP-1502 Hardware solutions / Firmware |
Vendor |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU63971
Risk: Low
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-31483
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote administrator can send a specially crafted HTTP request and upload arbitrary file anywhere on the filesystem.
MitigationInstall updates from vendor's website.
Vulnerable software versionsLNL-X2210: before 1.271
LNL-X2220: before 1.271
LNL-X3300: before 1.271
LNL-X4420: before 1.271
LNL-4420: before 1.271
S2-LP-1501: before 1.271
S2-LP-4502: before 1.271
S2-LP-2500: before 1.271
S2-LP-1502: before 1.271
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-153-01
http://www.corporate.carrier.com/Images/CARR-PSA-HID-Mercury-Vulnerabilities-006-0622_tcm558-170514...
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.