CVE-2019-7268

Product affected: Linear eMerge 50P/5000P devices. Vulnerable component: unrestricted/unauthenticated file upload during firmware upgrade. Root cause: lack of validation in the upload mechanism allows arbitrary file uploads to web root, enabling remote code execution with web server privileges. V...

CVE-2019-7266

Summary (CVE-2019-7266) : The Linear eMerge 50P/5000P access-control system contains an authentication bypass vulnerability (Improper Authentication, CWE-287) affecting versions up to 4.6.07 (revision 79330) and earlier. Exploitation could allow a remote attacker to bypass login checks and gain u...

CVE-2019-7269

The authenticated command-injection vulnerability CVE-2019-7269 affects Linear eMerge 50P/5000P devices (versions 4.6.07 and earlier). Root cause: the application constructs OS commands from externally influenced input without proper neutralization, enabling remote command execution with web serv...

CVE-2019-7267

Linear eMerge 50P/5000P devices are affected by CVE-2019-7267 (Cookie Path Traversal). Public documents confirm the vulnerability exists in Linear eMerge 50P/5000P, with affected versions up to 4.6.07 (and prior). CVSS details indicate network-exposed, low complexity, no authentication, with high...

CVE-2019-7271

CVE-2019-7271 concerns Nortek Linear eMerge 50P/5000P devices where the issue is the use of default credentials. Red Hat’s analyses tie this to admin credential exposure (e.g., credentials present in /test.txt for E3-Series) which can enable an attacker to open building doors when default credent...

CVE-2019-7270

Linear eMerge 50P/5000P devices are affected by a CSRF vulnerability (CVE-2019-7270) in the web application. The issue arises from insufficient validation of requests from trusted users, enabling an attacker to induce unwanted actions if a user is authenticated. ICSA notes remote exploitation pot...