CVE-2022-46381
Published: 13 December 2022
Summary
CVE-2022-46381 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Niceforyou Linear Emerge E3 Access Control Firmware. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Certain Linear eMerge E3-Series access control devices are affected by a reflected cross-site scripting vulnerability (CWE-79) that can be triggered via the type parameter in the badging/badge_template_v0.php endpoint. The flaw impacts firmware versions 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e, and carries a CVSS 3.1 score of 6.1.
An unauthenticated remote attacker can supply a crafted link containing malicious JavaScript in the type parameter; when a user with an active session follows the link, script executes in the context of the application with the victim’s privileges, enabling theft of session tokens or limited modification of application data.
Public disclosure material consists of a technical write-up hosted on GitHub that demonstrates the injection vector but contains no vendor advisory, patch information, or mitigation guidance. The CVE’s EPSS score has reached a peak of 0.8313 with a current value of 0.7750, indicating sustained exploitation interest after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-49190
Vulnerability details
Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component). This affects 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.