Experts Alert Linear eMerge E3 Systems to a Serious Unpatched Vulnerability

An unpatched flaw in Nice Linear eMerge E3 access controller systems could enable the execution of arbitrary operating system (OS) commands, according to cybersecurity security researchers.

According to VulnCheck, the vulnerability, which has been given the CVE identifier CVE-2024-9441, has a CVSS score of 9.8 out of a possible 10.0.

“A vulnerability in the Nortek Linear eMerge E3 allows remote unauthenticated attackers to cause the device to execute arbitrary command,” SSD Disclosure said in an advisory for the flaw released late last month, stating the vendor has yet to provide a fix or a workaround.

The following Nortek Linear eMerge E3 Access Control versions are affected by the defect: 1.00.05 and 1.00.07, 0.32-03i, 0.32-04m, 0.32-05p, 0.32-05z, 0.32-07p, 0.32-07e, 0.32-08e, 0.32-08f, 0.32-09c, and 1.00.05.

After being made public, proof-of-concept (PoC) exploits for the vulnerability were made available, which sparked worries that threat actors might take advantage of it.

Notably, a threat actor called Flax Typhoon used another critical vulnerability that affected E3, CVE-2019-7256 (CVSS score: 10.0), to enlist vulnerable devices into the now-demolished Raptor Train botnet.

Even though the issue was first revealed in May 2019, the company didn’t fix it until earlier this March.

“But given the vendor’s slow response to the previous CVE-2019-7256, we don’t expect a patch for CVE-2024-9441 any time soon,” VulnCheck’s Jacob Baines said. “Organizations using the Linear Emerge E3 series should act quickly to take these devices offline or isolate them.”

According to a statement provided to SSD Disclosure, Nice advises users to adhere to security best practices, which include limiting internet access to the product, implementing network segmentation, and setting it up behind a network firewall.