Summary: Researchers have identified a critical unpatched vulnerability (CVE-2024-9441) in the Nice Linear eMerge E3 access controller systems, allowing remote attackers to execute arbitrary OS commands. The flaw has a CVSS score of 9.8 and poses significant risks, especially given the vendor’s slow response to previous vulnerabilities.
Threat Actor: Flax Typhoon | Flax Typhoon
Victim: Nortek Linear eMerge E3 | Nortek Linear eMerge E3
Key Point :
- The vulnerability allows remote unauthenticated attackers to execute arbitrary commands on the device.
- Proof-of-concept exploits have been released, increasing the risk of exploitation by threat actors.
- The vendor has not yet provided a fix or workaround, raising concerns about the security of affected devices.
- Organizations are advised to isolate or take affected devices offline to mitigate risks.
- Best practices recommended include network segmentation and restricting internet access to the product.
Cybersecurity researchers are warning about an unpatched vulnerability in Nice Linear eMerge E3 access controller systems that could allow for the execution of arbitrary operating system (OS) commands.
The flaw, assigned the CVE identifier CVE-2024-9441, carries a CVSS score of 9.8 out of a maximum of 10.0, according to VulnCheck.
“A vulnerability in the Nortek Linear eMerge E3 allows remote unauthenticated attackers to cause the device to execute arbitrary command,” SSD Disclosure said in an advisory for the flaw released late last month, stating the vendor has yet to provide a fix or a workaround.
The flaw impacts the following versions of Nortek Linear eMerge E3 Access Control: 0.32-03i, 0.32-04m, 0.32-05p, 0.32-05z, 0.32-07p, 0.32-07e, 0.32-08e, 0.32-08f, 0.32-09c, 1.00.05, and 1.00.07.
Proof-of-concept (PoC) exploits for the flaw have been released following public disclosure, raising concerns that it could be exploited by threat actors.
It’s worth noting that another critical flaw impacting E3, CVE-2019-7256 (CVSS score: 10.0), was exploited by a threat actor known as Flax Typhoon to recruit susceptible devices into the now-dismantled Raptor Train botnet.
Although originally disclosed in May 2019, the shortcoming wasn’t addressed by the company until earlier this March.
“But given the vendor’s slow response to the previous CVE-2019-7256, we don’t expect a patch for CVE-2024-9441 any time soon,” VulnCheck’s Jacob Baines said. “Organizations using the Linear Emerge E3 series should act quickly to take these devices offline or isolate them.”
In a statement shared with SSD Disclosure, Nice is recommending customers to follow security best practices, including enforcing network segmentation, restricting access to the product from the internet, and placing it behind a network firewall.
Source: https://thehackernews.com/2024/10/experts-warn-of-critical-unpatched.html