https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T19:16:33.364988+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2022-31486 CVE-2022-31486 — Command injection via Advanced Networking route add functionality 2026-09-28T19:16:33.516372+00:00

Affected: LenelS2 LNL-X2210, LenelS2 LNL-X2220, LenelS2 LNL-X3300, LenelS2 LNL-X4420, LenelS2 LNL-4420, LenelS2 S2-LP-1501, LenelS2 S2-LP-1502, LenelS2 S2-LP-2500, LenelS2 S2-LP-4502, HID Mercury LP1501 and 4 more

An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.

 https://vulnerability.circl.lu/vuln/icsa-22-153-01 ICSA-22-153-01 — Carrier LenelS2 HID Mercury access panels 2026-09-28T19:16:33.516593+00:00

An unauthenticated attacker can update the hostname with a specially crafted name, allowing shell command execution during the core collection process.CVE-2022-31479 has been assigned to this vulnerability. A CVSS v3 base score of 9.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a denial-of-service condition.CVE-2022-31480 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer.CVE-2022-31481 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer.CVE-2022-31482 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). An authenticated attacker can manipulate a filename to achieve the ability to upload the desired file anywhere on the filesystem.CVE-2022-31483 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:…