Vulnerabilities

Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256.

Linear eMerge E3-Series devices allow Unrestricted File Upload.

CVE-2019-7256 is a critical (CVSS 9.8) unauthenticated OS command injection flaw (CWE-78) in the web interface of Nice/Nortek Control Linear eMerge E3-Series access control controllers. An unauthenticated remote attacker can send crafted HTTP requests to the controller's web endpoints — public proofs of concept target card_scan.php and card_scan_decoder.php on firmware 1.00-06 — causing arbitrary operating-system commands to run on the device. Successful exploitation yields full command execution on the controller, enabling takeover of the building access system and, as observed in the wild, conscription of exposed devices into DDoS botnets. Any site running Linear eMerge E3-Series Essential or Elite firmware is affected, especially controllers directly reachable from the internet. Exploitation is confirmed: public PoCs date to 2019, the bug was added to CISA's KEV catalog on 2024-03-25 amid reported active exploitation, and EPSS assigns a 97.1% probability of exploitation within 30 days (100th percentile).

Do: Remove E3-Series controllers from direct internet exposure (restrict the web interface to management networks or VPN) and check exposed devices for signs of botnet compromise, such as unusual outbound traffic. Because CISA's required action is to remediate firmware per the vendor advisory, contact Nice/Nortek Control for current firmware and remediation guidance, and treat the flaw as actively exploited given the KEV listing and 97.1% EPSS.

Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.

Nortek Linear eMerge 50P/5000P devices have Default Credentials.

A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior. A remote attacker may be able to execute arbitrary code on a target machine with elevated privileges.