Default credentials

Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. This occurs in situations where the CVE-2019-7271 default credentials have been changed...

CVE-2022-31499

Nortek Linear eMerge E3-Series devices running firmware before 0.32-08f are vulnerable to an unauthenticated remote OS command injection via the ReaderNo parameter. This vulnerability is an incomplete fix for CVE-2019-7256 . A successful attack allows an attacker to execute arbitrary commands, ex...

CVE-2022-31499

Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256...

CVE-2022-31269

Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. This occurs in situations where the CVE-2019-7271 default credentials have been changed...

CVE-2022-31269

Linear eMerge E3-Series devices are affected by CVE-2022-31269. Admin credentials are stored in clear text at the endpoint /test.txt (when default credentials have been changed), allowing an attacker to obtain admin credentials and access the admin dashboard to control doors, cameras, and related...

CVE-2022-31798: Session Fixation

Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /cardscan.php?CardFormatNo= XSS with session fixation via PHPSESSID when they are chained together. This would allow an attacker to take over an admin account or a user account...

CVE-2022-31499: Improper Neutralization of Special Elements used in an OS Command

Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256...

CVE-2022-31269: Use of Hard-coded Credentials

Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. This occurs in situations where the CVE-2019-7271 default credentials have been changed...

PT-2022-20657 · Nortek Linear · Emerge E3-Series

Name of the Vulnerable Software and Affected Versions: Nortek Linear eMerge E3-Series devices versions 0.32-09c and earlier Description: The issue allows an attacker to obtain admin credentials stored in /test.txt, which can be used to open a building's doors. This occurs even when default...

cras:cras_fl_media_fuzzer: Heap-buffer-overflow in linear_resampler_resample

Detailed Report: https://oss-fuzz.com/testcase?key=5885015791108096 Project: cras Fuzzing Engine: honggfuzz Fuzz Target: crasflmediafuzzer Job Type: honggfuzzasancras Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x62d00001c414 Crash State: linearresamplerresample...

UBUNTU-CVE-2022-2503

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear...

CVE-2022-2503: Authentication Bypass by Assumed-Immutable Data

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear...

Nortek Linear eMerge E3-Series Command Injection

Exploit Title: Nortek Linear eMerge E3-Series - Blind OS Command Injection Exploit Author: Omar Hashim Version: 0.32-09c Vendor home page: https://www.nortekcontrol.com/access-control/ Vendor home page: https://linear-solutions.com/ Authentication Required: No CVE: CVE-2022-31499 POC:...

Nortek Linear eMerge E3-Series Credential Disclosure

Exploit Title: Nortek Linear eMerge E3-Series - Information Disclosure lead to access admin dashboard Exploit Author: Omar Hashim Version: 0.32-07p,0.32-07e,0.32-07p,0.32-08f,0.32-09c Vendor home page : https://www.nortekcontrol.com/access-control/ Vendor home page : https://linear-solutions.com/...

Nortek Linear eMerge E3-Series Account Takeover XSS Vulnerability

Nortek Linear eMerge E3-Series version 0.32-07p suffers from a vulnerability where session fixation tied with cross site scripting can allow for account takeover. Exploit Title: Nortek Linear eMerge E3-Series - Account Take Over Exploit Author: Omar Hashim Version: 0.32-07p Vendor home page:...

Nortek Linear eMerge E3-Series Credential Disclosure Vulnerability

Nortek Linear eMerge E3-Series versions 0.32-07p, 0.32-07e, 0.32-07p, 0.32-08f, and 0.32-09c suffer from an administrative credential disclosure vulnerability. Exploit Title: Nortek Linear eMerge E3-Series - Information Disclosure lead to access admin dashboard Exploit Author: Omar Hashim Version...

Nortek Linear eMerge E3-Series Account Takeover

Exploit Title: Nortek Linear eMerge E3-Series - Account Take Over Exploit Author: Omar Hashim Version: 0.32-07p Vendor home page: https://www.nortekcontrol.com/access-control/ Vendor home page: https://linear-solutions.com/ Authentication Required: No CVE: CVE-2022-31798 Description...

Nortek Control Linear eMerge E3-Series Trust Management Vulnerabilities

The Nortek Control Linear eMerge E3-Series is an access control from Nortek Control USA. It allows you to specify which doors a person can use to enter and exit a specified location at a specified time. A security vulnerability exists in the Nortek Control Linear eMerge E3-Series, which stems fro...

Nortek Control Linear eMerge E3-Series operating system command injection vulnerability

The Nortek Control Linear eMerge E3-Series is an access control from Nortek Control USA. It allows you to specify which doors can be used by people to enter and exit a specified location at a specified time. A security vulnerability exists in Nortek Control Linear eMerge E3-Series version 0.32-09...

Nortek Linear eMerge E3-Series Command Injection Vulnerability

Exploit Title: Nortek Linear eMerge E3-Series - Blind OS Command Injection Exploit Author: Omar Hashim Version: 0.32-09c Vendor home page: https://www.nortekcontrol.com/access-control/ Vendor home page: https://linear-solutions.com/ Authentication Required: No CVE: CVE-2022-31499 POC:...