Cyber Resilience

CVE-2022-46381

MediumPublic PoC

Published: 13 December 2022

Published
13 December 2022
Modified
22 April 2025
KEV Added
Patch
CVSS Score v3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score 0.7750 99.0th percentile
Risk Priority 59 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-46381 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Niceforyou Linear Emerge E3 Access Control Firmware. Its CVSS base score is 6.1 (Medium).

Operationally, ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Certain Linear eMerge E3-Series access control devices are affected by a reflected cross-site scripting vulnerability (CWE-79) that can be triggered via the type parameter in the badging/badge_template_v0.php endpoint. The flaw impacts firmware versions 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e, and carries a CVSS 3.1 score of 6.1.

An unauthenticated remote attacker can supply a crafted link containing malicious JavaScript in the type parameter; when a user with an active session follows the link, script executes in the context of the application with the victim’s privileges, enabling theft of session tokens or limited modification of application data.

Public disclosure material consists of a technical write-up hosted on GitHub that demonstrates the injection vector but contains no vendor advisory, patch information, or mitigation guidance. The CVE’s EPSS score has reached a peak of 0.8313 with a current value of 0.7750, indicating sustained exploitation interest after publication.

EU & UK References

Vulnerability details

Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component). This affects 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

niceforyou
linear emerge e3 access control firmware
0.32-07e, 0.32-07p, 0.32-08e, 0.32-08f, 0.32-09a

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-79

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

addresses: CWE-79

Validates web inputs to reject script-related content that could produce XSS.

addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

References