Experts Warn of Critical Unpatched Vulnerability in Linear eMerge E3 Systems

Cybersecurity security researchers are warning about an unpatched vulnerability in Nice Linear eMerge E3 access controller systems that could allow for the execution of arbitrary operating system (OS) commands.

The flaw, assigned the CVE identifier CVE-2024-9441, carries a CVSS score of 9.8 out of a maximum of 10.0, according to VulnCheck.

"A vulnerability in the Nortek Linear eMerge E3 allows remote unauthenticated attackers to cause the device to execute arbitrary command," SSD Disclosure said in an advisory for the flaw released late last month, stating the vendor has yet to provide a fix or a workaround.

The flaw impacts the following versions of Nortek Linear eMerge E3 Access Control: 0.32-03i, 0.32-04m, 0.32-05p, 0.32-05z, 0.32-07p, 0.32-07e, 0.32-08e, 0.32-08f, 0.32-09c, 1.00.05, and 1.00.07.

Proof-of-concept (PoC) exploits for the flaw have been released following public disclosure, raising concerns that it could be exploited by threat actors.

It's worth noting that another critical flaw impacting E3, CVE-2019-7256 (CVSS score: 10.0), was exploited by a threat actor known as Flax Typhoon to recruit susceptible devices into the now-dismantled Raptor Train botnet.

Although originally disclosed in May 2019, the shortcoming wasn't addressed by the company until earlier this March.

"But given the vendor's slow response to the previous CVE-2019-7256, we don't expect a patch for CVE-2024-9441 any time soon," VulnCheck's Jacob Baines said. "Organizations using the Linear Emerge E3 series should act quickly to take these devices offline or isolate them."

In a statement shared with SSD Disclosure, Nice is recommending customers to follow security best practices, including enforcing network segmentation, restrict access to the product from the internet, and place it behind a network firewall.