CVE-2022-31481: HID Mercury Controller Buffer Overflow

CVE-2022-31481 Overview

CVE-2022-31481 is a critical buffer overflow vulnerability affecting HID Mercury Intelligent Controllers and related Carrier LenelS2 access control products. An unauthenticated attacker can send a specially crafted update file to the device that overflows a buffer, allowing manipulation of normal code execution to execute arbitrary commands. This vulnerability enables complete device compromise without requiring any authentication, making it particularly dangerous for physical security infrastructure.

Critical Impact

Unauthenticated remote code execution allows attackers to monitor all device communications, modify onboard relays, change configuration files, and compromise physical access control systems.

Affected Products

• HID Global LP1501, LP1502, LP2500, LP4502 (firmware versions prior to 1.302)
• HID Global EP4502 (firmware versions prior to 1.296)
• Carrier LenelS2 LNL-4420, LNL-X2210, LNL-X2220, LNL-X3300, LNL-X4420
• Carrier LenelS2 S2-LP-1501, S2-LP-1502, S2-LP-2500, S2-LP-4502

Discovery Timeline

• June 6, 2022 - CVE-2022-31481 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-31481

Vulnerability Analysis

This vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow. The firmware update mechanism in affected HID Mercury Intelligent Controllers fails to properly validate the size of incoming update file data before copying it into a fixed-size buffer. This allows an attacker to overflow the buffer with specially crafted data, enabling control over program execution flow.

The vulnerability is particularly severe because it requires no authentication and can be exploited remotely over the network. Once exploited, an attacker gains the ability to execute arbitrary code with full system privileges on the access control device. Given that these controllers manage physical access to facilities, successful exploitation could allow attackers to unlock doors, disable alarms, monitor entry/exit patterns, or cause denial of service to physical security systems.

Root Cause

The root cause is insufficient bounds checking in the firmware update processing routine. When the device receives an update file, it copies the file contents into a buffer without verifying that the data size does not exceed the allocated buffer space. This is a classic example of unsafe memory handling that allows stack or heap corruption, depending on the buffer's memory allocation.

Attack Vector

The attack can be conducted remotely over the network by any unauthenticated user who can reach the device. The attacker crafts a malicious update file containing overflow data designed to overwrite critical memory structures such as return addresses or function pointers. When the overflow occurs, the attacker-controlled data redirects execution to shellcode or existing code gadgets, achieving arbitrary code execution.

The exploitation sequence involves:

1. Network reconnaissance to identify vulnerable HID Mercury controllers
2. Crafting a malicious firmware update file with overflow payload
3. Sending the crafted file to the device's update endpoint
4. Buffer overflow corrupts execution flow, executing attacker's code
5. Attacker gains persistent control over the access control device

Detection Methods for CVE-2022-31481

Indicators of Compromise

• Unexpected firmware update attempts to HID Mercury controllers from unauthorized IP addresses
• Anomalous network traffic patterns to/from access control devices, especially large file transfers
• Unexpected changes to device configuration files or relay states
• Access control system instability, unexpected reboots, or loss of communication
• Unauthorized door unlock events or alarm suppression without corresponding credential usage

Detection Strategies

• Implement network intrusion detection rules to monitor for suspicious firmware update traffic to access control systems
• Deploy network segmentation and monitor traffic crossing security zones to/from physical access control networks
• Utilize SentinelOne Singularity to detect anomalous process behavior on network endpoints that communicate with access control infrastructure
• Review access control system logs for unauthorized configuration changes or unexpected relay modifications

Monitoring Recommendations

• Establish baseline network behavior for all HID Mercury and LenelS2 access control devices
• Configure alerting for any firmware update attempts outside of scheduled maintenance windows
• Monitor access control device communications for signs of reconnaissance or exploitation attempts
• Implement continuous vulnerability scanning to identify unpatched devices in the environment

How to Mitigate CVE-2022-31481

Immediate Actions Required

• Update HID Mercury LP series controllers (LP1501, LP1502, LP2500, LP4502) to firmware version 1.302 or later
• Update HID Mercury EP4502 controllers to firmware version 1.296 or later
• Isolate access control networks from general corporate networks using VLANs and firewalls
• Restrict network access to vulnerable devices to only authorized management systems
• Implement network access control lists (ACLs) to block unauthorized access to device update endpoints

Patch Information

Vendor patches are available that address this vulnerability. For HID Global LP series controllers, firmware version 1.302 contains the fix. For EP series controllers, firmware version 1.296 addresses the vulnerability. Organizations should consult the Carrier Security Advisory for detailed patching guidance and download links for affected LenelS2 products.

Workarounds

• Place all affected access control devices behind network firewalls with strict ingress filtering
• Disable remote firmware update capabilities if not operationally required and use local update methods
• Implement network monitoring to detect and alert on any firmware update traffic to affected devices
• Deploy intrusion prevention systems (IPS) with signatures to detect buffer overflow exploitation attempts

# Example network ACL to restrict access to HID Mercury controllers
# Apply to router/firewall protecting access control network segment
# Allow only authorized management workstation (192.168.100.10) to access controllers
iptables -A FORWARD -s 192.168.100.10 -d 192.168.200.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -s 192.168.100.10 -d 192.168.200.0/24 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.200.0/24 -j DROP