CVE-2019-7256
Published: 02 July 2019
Summary
CVE-2019-7256 is a critical-severity OS Command Injection (CWE-78) vulnerability in Nortekcontrol Linear Emerge Essential Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
Linear eMerge E3-Series access control devices are affected by CVE-2019-7256, a command injection vulnerability tracked under CWE-78. The issue permits arbitrary command execution on the underlying system and carries a CVSS 3.1 base score of 9.8 reflecting network-accessible, unauthenticated attack vectors with high impact on confidentiality, integrity, and availability.
An unauthenticated attacker with network reachability can supply crafted input to trigger command injection, resulting in full control over the affected device without requiring user interaction or credentials. Public exploit code targeting firmware versions such as 1.00-06 has been published, confirming that remote code execution is achievable in practice.
Advisory references point to detailed technical write-ups and proof-of-concept material, but no vendor-supplied patches or configuration mitigations are described in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-16800
Vulnerability details
Linear eMerge E3-Series devices allow Command Injections.
- CWE(s)
- KEV Date Added
- 25 March 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates validation of all inputs to reject crafted strings that would be interpreted as OS commands, directly blocking the unauthenticated command-injection vector.
Enforces authentication and authorization checks before any device function processes input, eliminating the unauthenticated network RCE path described in the CVE.
Restricts the web interface and supporting services to only the minimum required functionality, reducing the attack surface that permits arbitrary command execution.