CVE-2019-7256criticalunder attackCWE-78

CVE-2019-7256

Published · Updated

Follow this CVE+ Monitor Linear eMerge E3-Series

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 97%
from disclosure to weapon133 days
Published on NVDJul 2
1st PoC+133d
metasploit+119d
CISA KEV+1728d
Action required by CISAfederal deadline: 2024-04-15

Contact the vendor for guidance on remediating firmware, per their advisory.

In short

Linear eMerge E3-Series devices allow attackers to inject and execute arbitrary system commands, potentially giving complete control over the device and the access systems it manages.

Technical detail

Command injection vulnerability in Linear eMerge E3-Series devices allows unauthenticated remote attackers to inject arbitrary OS commands via improperly sanitized input parameters. Exploitation results in arbitrary code execution with device privileges, compromising authentication and access control systems.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Linear eMerge E3-Series devices allow Command Injections.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.