CVE-2025-52546: Unrestricted Upload of File with Dangerous Type

E3 Site Supervisor Control firmware version 2.31F01 has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page...

CVE-2025-52550: Improper Verification of Cryptographic Signature

E3 Site Supervisor Control firmware version 2.31F01 firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade...

CVE-2025-52545: Insufficiently Protected Credentials

E3 Site Supervisor Control firmware version 2.31F01 RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services...

CVE-2025-52543: Use of Password Hash Instead of Password for Authentication

E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...

CVE-2025-52544: Improper Input Validation

E3 Site Supervisor Control firmware version 2.31F01 has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system...

PT-2025-35555

Name of the Vulnerable Software and Affected Versions: E3 Site Supervisor Control versions prior to 2.31F01 Description: E3 Site Supervisor Control’s floor plan feature allows an unauthenticated attacker to upload floor plan files. Uploading a specially crafted floor plan file can lead to a store...

CVE-2025-52548: Inclusion of Undocumented Features or Chicken Bits

E3 Site Supervisor Control firmware version 2.31F01 contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the...

Malicious code in @zalastax/nolb-_e3 (npm)

The package @zalastax/nolb-e3 was found to contain malicious code...

MAL-2025-9958 Malicious code in @zalastax/nolb-_e3 (npm)

The package @zalastax/nolb-e3 was found to contain malicious code...

VulnCheck KEV: CVE-2022-38627

Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection vulnerability via the idt parameter...

CVE-2019-7256

Linear eMerge E3-Series devices allow Command Injections...

CVE-2019-7255

Linear eMerge E3-Series devices allow XSS...

CVE-2019-7264

Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform...

CVE-2019-7265

Linear eMerge E3-Series devices allow Remote Code Execution root access over SSH...

Nice Linear eMerge E3

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary OS commands. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper...

CVE-2024-9441

The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary OS commands via the loginid parameter when invoking the forgotpassword functionality over HTTP...

Exploit for CVE-2024-9441

CVE-2024-9441-POC CVE-2024-9441 is a command injection vulner...

Exploit for CVE-2024-9441

Nortek Linear eMerge E3 Pre-Auth RCE PoC CVE-2024-9441...

CVE-2024-9441

The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary OS commands via the loginid parameter when invoking the forgotpassword functionality over HTTP...

CVE-2024-9441 Linear eMerge e3-Series Forgot Password Command Injection

The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary OS commands via the loginid parameter when invoking the forgotpassword functionality over HTTP...