Experts Warn of Critical Unpatched Vulnerability in Linear eMerge E3 Systems

CVE-2019-7256 is a critical (CVSS 9.8) unauthenticated OS command injection flaw (CWE-78) in the web interface of Nice/Nortek Control Linear eMerge E3-Series access control controllers. An unauthenticated remote attacker can send crafted HTTP requests to the controller's web endpoints — public proofs of concept target card_scan.php and card_scan_decoder.php on firmware 1.00-06 — causing arbitrary operating-system commands to run on the device. Successful exploitation yields full command execution on the controller, enabling takeover of the building access system and, as observed in the wild, conscription of exposed devices into DDoS botnets. Any site running Linear eMerge E3-Series Essential or Elite firmware is affected, especially controllers directly reachable from the internet. Exploitation is confirmed: public PoCs date to 2019, the bug was added to CISA's KEV catalog on 2024-03-25 amid reported active exploitation, and EPSS assigns a 97.1% probability of exploitation within 30 days (100th percentile).

Do: Remove E3-Series controllers from direct internet exposure (restrict the web interface to management networks or VPN) and check exposed devices for signs of botnet compromise, such as unusual outbound traffic. Because CISA's required action is to remediate firmware per the vendor advisory, contact Nice/Nortek Control for current firmware and remediation guidance, and treat the flaw as actively exploited given the KEV listing and 97.1% EPSS.

CVE-2024-9441 is a critical OS command injection flaw (CWE-78) in Linear eMerge e3-Series access control controllers running version 1.00-07 and earlier. An unauthenticated remote attacker can send a crafted HTTP request to the forgot_password functionality, injecting arbitrary OS commands through the login_id parameter, which the controller then executes. Successful exploitation yields full command execution on the device, allowing the attacker to compromise the controller, access or alter credentials, and potentially pivot into the building's access control environment or the connected network. Any organization running an eMerge e3-Series controller at or below version 1.00-07 is affected, particularly units with their web interface reachable from the internet. As of disclosure, there is no known public proof-of-concept and the flaw is not in CISA KEV, but the high EPSS score (53.5%, 99th percentile) indicates an elevated likelihood of exploitation attempts within 30 days.

Do: The headline reporting indicates the flaw is currently unpatched, so until Linear/Nortek ships a fix for versions beyond 1.00-07, restrict the controller's web interface to trusted management networks via firewall rules or VPN and avoid exposing the forgot_password endpoint to the internet. Check HTTP access logs for requests to the forgot_password functionality containing shell metacharacters or unexpected values in the login_id parameter, and monitor for anomalous commands on the device. Apply the vendor firmware update as soon as one becomes available.