9.8Kritisch
KEV
CVE-2019-7256Nice Linear eMerge E3-Series OS Command Injection Vulnerability
Bekannt ausgenutzt — Nice Linear eMerge E3-Series OS Command Injection Vulnerability
CISA hat am 25.03.2024 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 15.04.2024.
Erforderliche Maßnahme: Contact the vendor for guidance on remediating firmware, per their advisory. https://linear-solutions.com/wp-content/uploads/E3-Bulletin-06-27-2023.pdf, https://www.cisa.gov/news-events/ics-advisories/icsa-24-065-01; https://nvd.nist.gov/vuln/detail/CVE-2019-7256
Beschreibung
Linear eMerge E3-Series devices allow Command Injections.
Schwachstellentyp (CWE):
CWE-78
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| nortekcontrol | linear_emerge_elite_firmware | 1.00-06 | |
| nortekcontrol | linear_emerge_essential_firmware | 1.00-06 |
Referenzen und Patches
- https://applied-risk.com/labs/advisories Not Applicable
- https://www.applied-risk.com/resources/ar-2019-005 Third Party Advisory
- http://packetstormsecurity.com/files/155255/Linear-eMerge-E3-1.00-06-card_scan.php-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/155256/Linear-eMerge-E3-1.00-06-card_scan_decoder.php-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/155272/Linear-eMerge-E3-Access-Controller-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/170372/Linear-eMerge-E3-Series-Access-Controller-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7256 US Government Resource
CPE-Treffer (NVD) (2)
cpe:2.3:o:nortekcontrol:linear_emerge_essential_firmware:*:*:*:*:*:*:*:*≤ 1.00-06cpe:2.3:o:nortekcontrol:linear_emerge_elite_firmware:*:*:*:*:*:*:*:*≤ 1.00-06