CVE-2022-38627

Deeper analysis

Nortek Linear eMerge E3-Series access control systems in versions 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e contain a SQL injection vulnerability that can be triggered through the idt parameter. The flaw is tracked as CWE-89 and carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.

An unauthenticated remote attacker can supply crafted input to the affected parameter and execute arbitrary SQL commands against the backend database. Successful exploitation grants the ability to read, modify, or delete data and potentially take full control of the affected system, consistent with the complete confidentiality, integrity, and availability impact described in the CVSS vector.

Public references consist of proof-of-concept files hosted on GitHub that demonstrate the injection and provide an accompanying Nuclei template; no vendor advisory or patch information is included in the available references.

The CVE maintains a high EPSS score, recorded at 0.7207 currently after reaching a peak of 0.7621.