CVE-2019-7256 - OpenCVE

Linear eMerge E3-Series devices allow Command Injections.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Nortekcontrol	Linear Emerge Elite Linear Emerge Elite Firmware Linear Emerge Essential Linear Emerge Essential Firmware

Configuration 1 [-]

AND

cpe:2.3:o:nortekcontrol:linear_emerge_essential_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:nortekcontrol:linear_emerge_essential:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:nortekcontrol:linear_emerge_elite_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:nortekcontrol:linear_emerge_elite:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/155255/Linear-eMerge-E3-1.00-06-card_scan.php-Command-Injection.html
http://packetstormsecurity.com/files/155256/Linear-eMerge-E3-1.00-06-card_scan_decoder.php-Command-Injection.html
http://packetstormsecurity.com/files/155272/Linear-eMerge-E3-Access-Controller-Command-Injection.html
http://packetstormsecurity.com/files/170372/Linear-eMerge-E3-Series-Access-Controller-Command-Injection.html
https://applied-risk.com/labs/advisories
https://www.applied-risk.com/resources/ar-2019-005

History

Tue, 13 Aug 2024 19:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 10.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-07-02T00:00:00

Updated: 2024-08-04T20:46:45.713Z

Reserved: 2019-01-31T00:00:00

Link: CVE-2019-7256

Vulnrichment

Updated: 2024-08-04T20:46:45.713Z

NVD

Status : Analyzed

Published: 2019-07-02T19:15:11.147

Modified: 2024-08-13T19:20:23.200

Link: CVE-2019-7256

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2019-7256", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-04T20:46:45.713Z", "dateReserved": "2019-01-31T00:00:00", "datePublished": "2019-07-02T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-01-05T00:00:00"}, "descriptions": [{"lang": "en", "value": "Linear eMerge E3-Series devices allow Command Injections."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://applied-risk.com/labs/advisories"}, {"url": "https://www.applied-risk.com/resources/ar-2019-005"}, {"url": "http://packetstormsecurity.com/files/155255/Linear-eMerge-E3-1.00-06-card_scan.php-Command-Injection.html"}, {"url": "http://packetstormsecurity.com/files/155256/Linear-eMerge-E3-1.00-06-card_scan_decoder.php-Command-Injection.html"}, {"url": "http://packetstormsecurity.com/files/155272/Linear-eMerge-E3-Access-Controller-Command-Injection.html"}, {"url": "http://packetstormsecurity.com/files/170372/Linear-eMerge-E3-Series-Access-Controller-Command-Injection.html"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2019-7256", "role": "CISA Coordinator", "options": [{"Exploitation": "Active"}, {"Automatable": "Yes"}, {"Technical Impact": "Total"}], "version": "2.0.3", "timestamp": "2024-03-27T04:00:11.102367Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2024-03-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7256"}}}], "affected": [{"cpes": ["cpe:2.3:o:nortekcontrol:linear_emerge_essential_firmware:1.00-06:*:*:*:*:*:*:*"], "vendor": "nortekcontrol", "product": "linear_emerge_essential_firmware", "versions": [{"status": "affected", "version": "1.00-06"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:nortekcontrol:linear_emerge_elite_firmware:1.00-06:*:*:*:*:*:*:*"], "vendor": "nortekcontrol", "product": "linear_emerge_elite_firmware", "versions": [{"status": "affected", "version": "1.00-06"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:11:59.777Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T20:46:45.713Z"}, "title": "CVE Program Container", "references": [{"url": "https://applied-risk.com/labs/advisories", "tags": ["x_transferred"]}, {"url": "https://www.applied-risk.com/resources/ar-2019-005", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/155255/Linear-eMerge-E3-1.00-06-card_scan.php-Command-Injection.html", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/155256/Linear-eMerge-E3-1.00-06-card_scan_decoder.php-Command-Injection.html", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/155272/Linear-eMerge-E3-Access-Controller-Command-Injection.html", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/170372/Linear-eMerge-E3-Series-Access-Controller-Command-Injection.html", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://applied-risk.com/labs/advisories", "tags": ["x_transferred"]}, {"url": "https://www.applied-risk.com/resources/ar-2019-005", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/155255/Linear-eMerge-E3-1.00-06-card_scan.php-Command-Injection.html", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/155256/Linear-eMerge-E3-1.00-06-card_scan_decoder.php-Command-Injection.html", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/155272/Linear-eMerge-E3-Access-Controller-Command-Injection.html", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/170372/Linear-eMerge-E3-Series-Access-Controller-Command-Injection.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T20:46:45.713Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2019-7256", "role": "CISA Coordinator", "options": [{"Exploitation": "Active"}, {"Automatable": "Yes"}, {"Technical Impact": "Total"}], "version": "2.0.3", "timestamp": "2024-03-27T04:00:11.102367Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2024-03-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7256"}}}], "affected": [{"cpes": ["cpe:2.3:o:nortekcontrol:linear_emerge_essential_firmware:1.00-06:*:*:*:*:*:*:*"], "vendor": "nortekcontrol", "product": "linear_emerge_essential_firmware", "versions": [{"status": "affected", "version": "1.00-06"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:nortekcontrol:linear_emerge_elite_firmware:1.00-06:*:*:*:*:*:*:*"], "vendor": "nortekcontrol", "product": "linear_emerge_elite_firmware", "versions": [{"status": "affected", "version": "1.00-06"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-01T17:06:56.045Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://applied-risk.com/labs/advisories"}, {"url": "https://www.applied-risk.com/resources/ar-2019-005"}, {"url": "http://packetstormsecurity.com/files/155255/Linear-eMerge-E3-1.00-06-card_scan.php-Command-Injection.html"}, {"url": "http://packetstormsecurity.com/files/155256/Linear-eMerge-E3-1.00-06-card_scan_decoder.php-Command-Injection.html"}, {"url": "http://packetstormsecurity.com/files/155272/Linear-eMerge-E3-Access-Controller-Command-Injection.html"}, {"url": "http://packetstormsecurity.com/files/170372/Linear-eMerge-E3-Series-Access-Controller-Command-Injection.html"}], "descriptions": [{"lang": "en", "value": "Linear eMerge E3-Series devices allow Command Injections."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-01-05T00:00:00"}}}, "cveMetadata": {"cveId": "CVE-2019-7256", "state": "PUBLISHED", "dateUpdated": "2024-08-04T20:46:45.713Z", "dateReserved": "2019-01-31T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2019-07-02T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"cisaActionDue": "2024-04-15", "cisaExploitAdd": "2024-03-25", "cisaRequiredAction": "Contact the vendor for guidance on remediating firmware, per their advisory.", "cisaVulnerabilityName": "Nice Linear eMerge E3-Series OS Command Injection Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:nortekcontrol:linear_emerge_essential_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6732033A-E740-473B-9929-5D3267E938A9", "versionEndIncluding": "1.00-06", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:nortekcontrol:linear_emerge_essential:-:*:*:*:*:*:*:*", "matchCriteriaId": "92DB5201-9021-4302-B484-D846439BBC96", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:nortekcontrol:linear_emerge_elite_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDD3F346-1C4C-4EA6-9696-7BCF3C169224", "versionEndIncluding": "1.00-06", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:nortekcontrol:linear_emerge_elite:-:*:*:*:*:*:*:*", "matchCriteriaId": "3465CA75-36C8-49E6-98BD-FFCE518E5399", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Linear eMerge E3-Series devices allow Command Injections."}, {"lang": "es", "value": "Los dispositivos Linear eMerge E3-Series permiten Inyecciones de Comando."}], "id": "CVE-2019-7256", "lastModified": "2024-08-13T19:20:23.200", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2019-07-02T19:15:11.147", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/155255/Linear-eMerge-E3-1.00-06-card_scan.php-Command-Injection.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/155256/Linear-eMerge-E3-1.00-06-card_scan_decoder.php-Command-Injection.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/155272/Linear-eMerge-E3-Access-Controller-Command-Injection.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/170372/Linear-eMerge-E3-Series-Access-Controller-Command-Injection.html"}, {"source": "cve@mitre.org", "tags": ["Not Applicable"], "url": "https://applied-risk.com/labs/advisories"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.applied-risk.com/resources/ar-2019-005"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}