Plattform
linux
Komponente
hid-mercury-intelligent-controllers
Behoben in
1.271
1.271
1.271
1.271
1.271
1.271
1.271
1.271
1.271
1.271
1.271
1.271
1.271
1.271
CVE-2022-31483 describes an Arbitrary File Access vulnerability present in HID Mercury Intelligent Controllers running firmware versions prior to 1.271. This vulnerability allows an authenticated attacker to upload files with manipulated filenames, enabling them to overwrite sensitive system files. Successful exploitation can lead to root access on the underlying Linux operating system, posing a significant security risk.
The impact of CVE-2022-31483 is severe. An attacker exploiting this vulnerability can upload arbitrary files to any location on the controller's filesystem. This allows for the overwriting of critical system files, potentially leading to a complete compromise of the device. The attacker could install a startup service to maintain persistent remote access with root privileges, effectively establishing a backdoor. This could be leveraged for data exfiltration, denial of service, or further attacks against connected systems. The ability to gain root access represents a significant escalation of privileges and a substantial blast radius.
CVE-2022-31483 was publicly disclosed on June 6, 2022. While no active exploitation campaigns have been publicly confirmed, the vulnerability's critical severity and ease of exploitation make it a potential target. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are not widely available, but the vulnerability's nature suggests that development is likely. The ability to achieve root access with relative ease increases the likelihood of exploitation.
Organizations utilizing HID Mercury Intelligent Controllers in industrial control systems, building automation networks, or any environment where these controllers manage critical infrastructure are at significant risk. Specifically, deployments relying on older firmware versions (≤1.271) and those with limited network segmentation are particularly vulnerable. Shared hosting environments where multiple tenants share the same controller hardware also present an increased risk surface.
• linux / server:
journalctl -u hid-mercury -f | grep -i "upload"• linux / server:
find / -name '*..*' -print 2>/dev/null• linux / server:
lsof -i :8080 # Check for unusual processes listening on web portsdisclosure
Exploit-Status
EPSS
0.62% (70% Perzentil)
CVSS-Vektor
The primary mitigation for CVE-2022-31483 is to upgrade the HID Mercury Intelligent Controllers firmware to version 1.271 or later. If an immediate upgrade is not possible due to compatibility concerns or system downtime requirements, consider implementing stricter file upload validation on the web interface to prevent the injection of malicious filenames containing “..” and “/”. While not a complete solution, this can reduce the attack surface. Monitor system logs for unusual file creation or modification activity, particularly in sensitive system directories. After upgrading the firmware, verify the fix by attempting a file upload with a filename containing “..” and “/” – the upload should be rejected.
Aktualisieren Sie die Firmware der HID Mercury Intelligent Controllers auf Version 1.271 oder höher. Dies behebt die Schwachstelle, die eine beliebige Dateischreibung und möglicherweise die Erlangung von Remote-Zugriff mit Root-Rechten ermöglicht.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2022-31483 is a critical vulnerability allowing authenticated attackers to upload files to any location on HID Mercury Intelligent Controllers, potentially leading to root access and system compromise.
You are affected if you are using HID Mercury Intelligent Controllers with firmware versions equal to or less than 1.271. Check your firmware version and upgrade immediately if necessary.
The recommended fix is to upgrade the firmware to version 1.271 or later. Implement stricter file upload validation as a temporary workaround if an upgrade is not immediately possible.
While no active exploitation campaigns have been publicly confirmed, the vulnerability's severity and ease of exploitation suggest it is a potential target.
Refer to the HID advisory for detailed information and updates: https://www.hidglobal.com/security-advisory/hid-mercury-intelligent-controllers-arbitrary-file-access-vulnerability
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.