by Kastro
Paper/Archive/CVE-2024-9441

CVE-2024-9441

Linear eMerge e3-Series — Linear eMerge e3-Series Forgot Password Command Injection

EPSS 53%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.0.990 × 2019.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary OS commands via the login_id parameter when invoking the forgot_password functionality over HTTP.

Affected

ProductAffectedFixed inSource
eMerge e3-Series≤ 1.00-07–CNA
emerge_e3_firmware≤ 1.00-07–CISA-ADP

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitssd-disclosure.com/ssd-advisory-nortek-linear-emerge-e3-pre-auth-rcewriteupvulncheck.com/advisories/linear-emerge-forgot-password