Actively exploited · Published Jul 2, 2019 · Assigned by mitre
CVE-2019-7256
Critical 9.8 Exploited
In plain English
A critical-severity OS command injection in Linear eMerge E3-Series from Nice. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2024). The chance it is exploited in the next 30 days is estimated at 97.1% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Contact the vendor for guidance on remediating firmware, per their advisory.
CISA guidance
Contact the vendor for guidance on remediating firmware, per their advisory.
Federal agencies must remediate by Apr 15, 2024.
Official description
Linear eMerge E3-Series devices allow Command Injections.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://applied-risk.com/labs/advisories
- https://www.applied-risk.com/resources/ar-2019-005
- http://packetstormsecurity.com/files/155255/Linear-eMerge-E3-1.00-06-card_scan.php-Command-Injection.html
- http://packetstormsecurity.com/files/155256/Linear-eMerge-E3-1.00-06-card_scan_decoder.php-Command-Injection.html
- http://packetstormsecurity.com/files/155272/Linear-eMerge-E3-Access-Controller-Command-Injection.html
- http://packetstormsecurity.com/files/170372/Linear-eMerge-E3-Series-Access-Controller-Command-Injection.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7256 government-resource