CVE-2024-9441

Nortek Linear eMerge E3 Pre-Auth RCE PoC CVE-2024-9441 Description: This repository contains a Proof of Concept PoC exploit for Nortek Linear eMerge E3 CVE-2024-9441, which is vulnerable to Remote Code Execution RCE in a pre-authentication state. The vulnerability is triggered via a flaw in the...

CVE-2022-31269

CVE : CVE-2022-31269 Exploit Title: Nortek Linear eMerge E3-Series - Information Disclosure leads to access admin dashboard...

CVE-2022-31269

CVE-2022-31269 Nortek Control Linear eMerge E3-Series Information Disclosure Optional Arguments: -h, --help show this help message and exit -u url, --url url Target url eg:"http://127.0.0.1" -f file, --file file Targets in file eg:"ip.txt" Use python3 CVE-2022-31269.py -u http://127.0.0.1 python3...

CVE-2022-31499

CVE-2022-31499 Exploit Title: Nortek Linear eMerge E3-Series - Blind OS Command Injection...

CVE-2022-31798

CVE-2022-31798 Exploit Title: Nortek Linear eMerge E3-Series - account takeover...

Linear eMerge E3-Series - Cross-Site Scripting

Linear eMerge E3-Series devices contain a cross-site scripting vulnerability via the type parameter, e.g., to the badging/badgetemplatev0.php component. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site and thus steal cookie-based...

Linear eMerge E3-Series - Information Disclosure

Linear eMerge E3-Series devices are susceptible to information disclosure. Admin credentials are stored in clear text at the endpoint /test.txt in situations where the default admin credentials have been changed. An attacker can obtain admin credentials, access the admin dashboard, control buildi...

eMerge E3 1.00-06 - Remote Code Execution

Linear eMerge E3-Series devices are susceptible to remote code execution vulnerabilities. id: CVE-2019-7256 info: name: eMerge E3 1.00-06 - Remote Code Execution author: pikpikcu severity: critical description: | Linear eMerge E3-Series devices are susceptible to remote code execution...

Nortek Linear eMerge E3-Series - SQL Injection

Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection vulnerability via the idt parameter. id: CVE-2022-38627 info: name: Nortek Linear eMerge E3-Series - SQL Injection author: daffainfo,omarhashem666...

Linear eMerge E3 - Cross-Site Scripting

Linear eMerge E3-Series devices are vulnerable to cross-site scripting via the 'layout' parameter. id: CVE-2019-7255 info: name: Linear eMerge E3 - Cross-Site Scripting author: arafatansari severity: medium description: | Linear eMerge E3-Series devices are vulnerable to cross-site scripting via...

Nortek Linear eMerge E3-Series - Cross-Site Scripting

There is a local session fixation vulnerability that, when chained with cross-site scripting, leads to account take over of admin or a lower privileged user. id: CVE-2022-31798 info: name: Nortek Linear eMerge E3-Series - Cross-Site Scripting author: ritikchaddha severity: medium description: |...

eMerge E3 1.00-06 - Local File Inclusion

Linear eMerge E3-Series devices are vulnerable to local file inclusion. id: CVE-2019-7254 info: name: eMerge E3 1.00-06 - Local File Inclusion author: 0xAkoko severity: high description: Linear eMerge E3-Series devices are vulnerable to local file inclusion. impact: | Successful exploitation of...

Nortek Linear eMerge E3-Series <0.32-08f - Remote Command Injection

Nortek Linear eMerge E3-Series devices before 0.32-08f are susceptible to remote command injection via ReaderNo. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. NOTE: this...

eMerge E3 1.00-06 - Local File Inclusion Detection

Linear eMerge E3-Series devices are vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Linear eMerge E3-Series devices are vulnerable to local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Linear eMerge E3 - Cross-Site Scripting Detection

Linear eMerge E3-Series devices are vulnerable to cross-site scripting via the 'layout' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Linear eMerge E3-Series devices are vulnerable to cross-site scripting via the 'layout' parameter.""" from kittysploit import from...

Nortek Linear eMerge E3-Series - Cross-Site Scripting Detection

There is a local session fixation vulnerability that, when chained with cross-site scripting, leads to account take over of admin or a lower privileged user. !/usr/bin/env python3 -- coding: utf-8 -- """There is a local session fixation vulnerability that, when chained with cross-site scripting,...

Linear eMerge E3-Series - Information Disclosure Detection

Linear eMerge E3-Series devices are susceptible to information disclosure. Admin credentials are stored in clear text at the endpoint /test.txt in situations where the default admin credentials have been changed. An attacker can obtain admin credentials, access the admin dashboard, control buildi...

Linear eMerge E3-Series - Cross-Site Scripting Detection

Linear eMerge E3-Series devices contain a cross-site scripting vulnerability via the type parameter, e.g., to the badging/badgetemplatev0.php component. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site and thus steal cookie-based...

Nortek Linear eMerge Panel - Detect

Nortek Linear eMerge panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nortek Linear eMerge panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nortek Linear eMerge Panel -...

CVE-2022-38628

Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting XSS vulnerability which is chained with a local session fixation. This vulnerability allows attackers to escalate privileges via unspecified...