CVE-2019-7256
Nice Linear eMerge E3-Series OS Command Injection Vulnerability
Description
CVE-2019-7256 is a critical command injection vulnerability in Nice (formerly Nortek Control) Linear eMerge E3-Series access control devices. With a CVSS v3.1 base score of 9.8, this flaw allows unauthenticated remote attackers to inject and execute arbitrary operating system commands on the device. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of April 15, 2024, and its ransomware association is classified as unknown. The EPSS score of 94.41% at the 100.0th percentile places this at the absolute top of all tracked vulnerabilities in terms of exploitation probability, confirming massive and sustained exploitation activity. Affected firmware versions include Linear eMerge Essential and Elite versions up through 1.00-06.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| nortekcontrol | linear emerge essential firmware | <= 1.00-06 |
| nortekcontrol | linear emerge elite firmware | <= 1.00-06 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/155255/Linear-eMerge-E3-1.00-06-card_scan.php-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155256/Linear-eMerge-E3-1.00-06-card_scan_decoder.php-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155272/Linear-eMerge-E3-Access-Controller-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/170372/Linear-eMerge-E3-Series-Access-Controller-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://applied-risk.com/labs/advisories(Not Applicable)
- https://www.applied-risk.com/resources/ar-2019-005(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7256(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2019-7256 by NVD. Based on the vulnerability characteristics, this is a command injection vulnerability (typically classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command). The Linear eMerge E3-Series devices expose web-accessible PHP scripts including card_scan.php and card_scan_decoder.php that accept user-supplied input and incorporate it directly into operating system shell commands without proper sanitization. The lack of input validation allows attackers to inject shell metacharacters and arbitrary commands that execute on the device's underlying Linux operating system. The combination of no authentication requirement and direct OS command execution makes this among the most trivially exploitable vulnerability patterns in embedded devices.
Impact Analysis
The impact of CVE-2019-7256 is catastrophic for organizations relying on Linear eMerge E3-Series devices for physical access control. Confidentiality is fully compromised because command execution on the access control device exposes the entire access control database, including cardholder information, access credentials, badge numbers, access schedules, and audit logs of who entered which doors and when. This physical security data is exceptionally sensitive for organizations in government, defense, healthcare, and critical infrastructure sectors.
Integrity faces maximum impact as the attacker can modify access control rules, grant unauthorized physical access to restricted areas, revoke legitimate access credentials, tamper with audit logs to hide unauthorized entries, and modify firmware to create persistent backdoors. An attacker who compromises a building access control system can grant themselves physical access to any area controlled by the system, creating a bridge between cyber and physical security compromise.
Availability is critically affected because the attacker can disable the access control system entirely, lock all doors in either open or closed positions, disrupt normal building operations, or render the device inoperable. The EPSS score of 94.41% at the 100.0th percentile means this is the most likely to be exploited of virtually all tracked vulnerabilities. The vulnerability has been known since 2019 but received significant renewed attention and exploitation activity, leading to the 2024 KEV listing. Many eMerge E3-Series installations are in critical infrastructure environments where physical access control compromise can have severe safety and security implications.
Exploit Maturity
CVE-2019-7256 has reached maximum exploit maturity with multiple public exploits, mass exploitation campaigns, and years of documented abuse. The EPSS score of 94.41% at the 100.0th percentile is the highest possible exploitation probability rating, confirming that this is among the most actively exploited vulnerabilities in existence. CISA's KEV listing with an April 15, 2024 deadline highlights ongoing exploitation nearly five years after initial disclosure.
Multiple public exploits are available through Packet Storm Security, documenting different exploitation paths through the device's PHP scripts: card_scan.php Command Injection, card_scan_decoder.php Command Injection, and a general Access Controller Command Injection. Additional exploits were published in 2023 at Packet Storm, demonstrating continued attacker interest. Applied Risk published the original advisory at AR-2019-005 documenting the vulnerability details. The trivial exploitation path (unauthenticated HTTP request), abundance of public exploit code, and years of exposure without widespread patching create ideal conditions for persistent mass exploitation.
Remediation
-
Apply firmware updates from Nice (formerly Nortek Control) for all Linear eMerge E3-Series devices. Contact the vendor or check the Nice/Linear support portal for patched firmware versions. Given that the vulnerability has been exploited since 2019 and carries a 94.41% EPSS score, any unpatched device should be considered compromised and requires both patching and forensic investigation.
-
Remove all internet exposure of eMerge E3-Series devices immediately as the most critical emergency measure. Physical access control systems should never be directly accessible from the internet. Remove any port forwarding rules, and ensure NAT configurations do not expose the device's web interface (typically port 80/443) to external networks.
-
Segment access control systems onto a dedicated security network isolated from the general corporate network and the internet. Implement firewall rules that restrict access to the eMerge E3 web interface to only authorized security management workstations. Physical access control networks should be treated as critical infrastructure with the highest segmentation priority.
-
Conduct a physical security audit if any eMerge E3-Series device was internet-exposed or accessible from untrusted networks. Review access control logs for unauthorized badge additions, permission changes, or suspicious access patterns. Verify that no unauthorized physical access credentials have been created and that audit logs have not been tampered with.
-
Evaluate replacement with modern access control systems if the installed firmware cannot be updated or if the vendor no longer supports the specific hardware revision. Access control systems that have been vulnerable for over five years with active exploitation represent an unacceptable risk, particularly in environments with regulatory requirements for physical security controls.
Technical Details
CVE-2019-7256 is a command injection vulnerability in Nice Linear eMerge E3-Series access control devices, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. All exploitability metrics are at their most severe values. Attack Vector (AV:N) confirms remote exploitation over the network. Attack Complexity (AC:L) means the exploit is trivially reliable. Privileges Required (PR:N) indicates no authentication is needed. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:U) remains unchanged within the device context. All impact metrics are High, reflecting complete device compromise.
The vulnerability exists in PHP scripts on the eMerge E3-Series web interface, specifically in card_scan.php and card_scan_decoder.php. These scripts accept user-supplied parameters through HTTP requests and pass them to operating system shell commands (likely via PHP's system(), exec(), or shell_exec() functions) without any input sanitization or validation. An attacker can inject arbitrary shell commands by including shell metacharacters such as semicolons (;), backticks, pipe characters (|), or command substitution syntax ($(command)) in the vulnerable parameters. The injected commands execute on the device's embedded Linux operating system with the privileges of the web server process, which on embedded devices typically has root or near-root access. The affected firmware versions 1.00-06 and earlier for both the eMerge Essential and eMerge Elite product lines run on embedded ARM or MIPS Linux platforms with minimal security hardening, no ASLR, no sandboxing, and often a permissive or absent SELinux configuration.
Frequently Asked Questions
What is CVE-2019-7256?
CVE-2019-7256 is a critical command injection vulnerability in Nice Linear eMerge E3-Series access control devices that allows unauthenticated remote attackers to execute arbitrary operating system commands. With a CVSS score of 9.8 and an EPSS score at the 100th percentile, it is one of the most actively exploited vulnerabilities tracked.
Why is a 2019 vulnerability still being actively exploited?
Many Linear eMerge E3-Series installations have not been patched because physical access control systems are often managed by facilities teams rather than IT security, firmware updates for embedded devices require specialized knowledge, and these devices are frequently overlooked in vulnerability management programs. The abundance of public exploits and trivial exploitation path ensure continued targeting.
What is the risk of a compromised building access control system?
A compromised access control system allows attackers to grant themselves physical access to restricted areas, revoke legitimate access, view building entry logs to track individuals' movements, and disable physical security controls. This bridges the gap between cyber and physical security and can endanger personnel safety.
How can I check if my eMerge E3 device is vulnerable?
Check the firmware version on your Linear eMerge E3-Series device through the web administration interface. Versions 1.00-06 and earlier are confirmed vulnerable. Contact Nice (the current vendor) for the latest firmware that addresses this vulnerability. Any internet-exposed device should be assumed compromised regardless of firmware version.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.