CVE-2024-9441

Description

The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary OS commands via the login_id parameter when invoking the forgot_password functionality over HTTP.

Reserved 2024-10-02 | Published 2024-10-02 | Updated 2024-10-02 | Assigner VulnCheck

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
unaffected

Any version
affected

References

ssd-disclosure.com/...-nortek-linear-emerge-e3-pre-auth-rce/ vendor-advisory exploit

vulncheck.com/advisories/linear-emerge-forgot-password third-party-advisory

cve.org (CVE-2024-9441)

nvd.nist.gov (CVE-2024-9441)

Download JSON