LenelS2 vulnerabilities
We track 10 vulnerabilities in LenelS2 products across 10 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on May 30, 2024.
Latest LenelS2 vulnerabilities
- 8.8 High severity
NetBox: Improper Neutralization of Argument Delimiters in a Command
LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands.
- 9.8 Critical severity
NetBox: Improper Neutralization of Special Elements used in an OS Command
LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions.
- 9.8 Critical severity
NetBox: Use of Hard-coded Password
LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements.
- 8.8 High severity
LNL-X2210: Improper Neutralization of Special Elements used in an OS Command
An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which co
- 7.5 High severity
LNL-X2210: Direct Request
An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware
- 8.8 High severity
LNL-X2210: Improper Limitation of a Pathname to a Restricted Directory
An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP
- 7.5 High severity
LNL-X2210: Buffer Copy without Checking Size of Input
An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which co
- 10.0 Critical severity
LNL-X2210: Buffer Copy without Checking Size of Input
An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware ve
- 7.5 High severity
LNL-X2210: Direct Request
An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502
- 9.8 Critical severity
LNL-X2210: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1