Linear eMerge E3 漏洞列表

Linear eMerge E3是一款门禁控制器。 Linear eMerge E3 forgot_password没有严格校验，允许远程未经身份验证的攻击者导致设备执行任意命令。

Linear eMerge E3-Series devices are vulnerable to cross-site scripting via the 'layout' parameter.

Linear eMerge E3-Series devices are susceptible to information disclosure. Admin credentials are stored in clear text at the endpoint /test.txt in situations where the default admin credentials have been changed. An attacker can obtain admin credentials, access the admin dashboard, control building access and cameras, and access employee information.

Nortek Linear eMerge E3-Series devices before 0.32-08f are susceptible to remote command injection via ReaderNo. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-7256.

There is a local session fixation vulnerability that, when chained with cross-site scripting, leads to account take over of admin or a lower privileged user.

Linear eMerge E3-Series devices contain a cross-site scripting vulnerability via the type parameter, e.g., to the badging/badge_template_v0.php component. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site and thus steal cookie-based authentication credentials and launch other attacks. This affects versions 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e.

eMergeE3系统的execute.php文件存在远程命令执行漏洞，攻击者能够通过构造恶意请求在系统中执行任意命令。该漏洞源于对用户输入数据缺乏严格的过滤和验证，可能导致未授权攻击者完全控制受影响设备，进行数据窃取、系统破坏或植入后门等恶意操作。建议用户尽快应用官方安全补丁或采取临时缓解措施，如限制对该文件的访问权限。

Linear eMerge E3-Series Devices存在目录遍历漏洞，此漏洞是由于设备对请求文件名没有进行充分验证导致的。

Linear eMerge E3 系列设备存在命令注入漏洞。此漏洞是由于对参数值校验不足导致的。

Linear eMerge E3-Series Devices存在跨站脚本漏洞，此漏洞是由于设备对用户输入没有进行充分验证导致的。

Linear eMerge E3 包含跨站点脚本漏洞。

Linear eMerge E3 系列是楼宇管理系统中行业领先的产品之一，因为它是行业中使用最广泛的产品之一。该系统badge_layout_new_v0.php存在任意文件上传漏洞，攻击者可通过该漏洞上传Webshell，获取服务器权限。

Linear eMerge E3 系列是楼宇管理系统中行业领先的产品之一，因为它是行业中使用最广泛的产品之一。该系统card_scan_decoder.php存在命令执行漏洞，攻击者可通过该漏洞执行系统命令，获取服务器权限。