Sign-up

ID

VAR-201907-0162


CVE

CVE-2019-7261


TITLE

Linear eMerge E3  Vulnerabilities related to the use of hard-coded credentials in series devices

Trust: 0.8

sources: JVNDB: JVNDB-2019-005914

DESCRIPTION

Linear eMerge E3-Series devices have Hard-coded Credentials. Linear eMerge E3 series devices contain a vulnerability related to the use of hardcoded credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Nortek Security & Control Linear eMerge E3-Series is an access control device from Nortek Security & Control, USA. Nortek Security & Control Linear eMerge E3-Series has a trust management issue vulnerability. An attacker could use this vulnerability to bypass authentication detection

Trust: 2.25

sources: NVD: CVE-2019-7261 // JVNDB: JVNDB-2019-005914 // CNVD: CNVD-2019-34630 // VULHUB: VHN-158696

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-34630

AFFECTED PRODUCTS

vendor:nortekcontrolmodel:linear emerge essentialscope:lteversion:1.00-06

Trust: 1.0

vendor:nortekcontrolmodel:linear emerge elitescope:lteversion:1.00-06

Trust: 1.0

vendor:nortekmodel:linear emerge elitescope: - version: -

Trust: 0.8

vendor:nortekmodel:linear emerge essentialscope: - version: -

Trust: 0.8

vendor:nortekmodel:security&control linear emerge e3-seriesscope:lteversion:<=1.00-06

Trust: 0.6

sources: CNVD: CNVD-2019-34630 // JVNDB: JVNDB-2019-005914 // NVD: CVE-2019-7261

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-7261
value: CRITICAL

Trust: 1.0

NVD: CVE-2019-7261
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2019-34630
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201907-102
value: CRITICAL

Trust: 0.6

VULHUB: VHN-158696
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-7261
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-34630
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-158696
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-7261
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2019-7261
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2019-34630 // VULHUB: VHN-158696 // JVNDB: JVNDB-2019-005914 // CNNVD: CNNVD-201907-102 // NVD: CVE-2019-7261

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.1

problemtype:Use hard-coded credentials (CWE-798) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-158696 // JVNDB: JVNDB-2019-005914 // NVD: CVE-2019-7261

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201907-102

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201907-102

PATCH

title:eMerge E3-Series Access Controlurl:https://www.nortekcontrol.com/pdf/literature/emerge-e3-series-brochure.pdf

Trust: 0.8

sources: JVNDB: JVNDB-2019-005914

EXTERNAL IDS

db:NVDid:CVE-2019-7261

Trust: 3.9

db:PACKETSTORMid:155267

Trust: 1.7

db:ICS CERTid:ICSA-24-065-01

Trust: 0.8

db:JVNid:JVNVU96911165

Trust: 0.8

db:JVNDBid:JVNDB-2019-005914

Trust: 0.8

db:CNNVDid:CNNVD-201907-102

Trust: 0.7

db:CNVDid:CNVD-2019-34630

Trust: 0.6

db:VULHUBid:VHN-158696

Trust: 0.1

sources: CNVD: CNVD-2019-34630 // VULHUB: VHN-158696 // JVNDB: JVNDB-2019-005914 // CNNVD: CNNVD-201907-102 // NVD: CVE-2019-7261

REFERENCES

url:https://www.applied-risk.com/resources/ar-2019-005

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2019-7261

Trust: 2.0

url:http://packetstormsecurity.com/files/155267/nortek-linear-emerge-e3-access-controller-1.00-06-ssh-ftp-remote-root.html

Trust: 1.7

url:https://applied-risk.com/labs/advisories

Trust: 1.7

url:https://jvn.jp/vu/jvnvu96911165/

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-24-065-01

Trust: 0.8

sources: CNVD: CNVD-2019-34630 // VULHUB: VHN-158696 // JVNDB: JVNDB-2019-005914 // CNNVD: CNNVD-201907-102 // NVD: CVE-2019-7261

CREDITS

LiquidWorm

Trust: 0.6

sources: CNNVD: CNNVD-201907-102

SOURCES

db:CNVDid:CNVD-2019-34630
db:VULHUBid:VHN-158696
db:JVNDBid:JVNDB-2019-005914
db:CNNVDid:CNNVD-201907-102
db:NVDid:CVE-2019-7261

LAST UPDATE DATE

2024-08-14T13:55:18.468000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2019-34630date:2019-10-11T00:00:00
db:VULHUBid:VHN-158696date:2019-11-12T00:00:00
db:JVNDBid:JVNDB-2019-005914date:2024-03-07T08:20:00
db:CNNVDid:CNNVD-201907-102date:2019-11-13T00:00:00
db:NVDid:CVE-2019-7261date:2022-10-14T01:20:26.870

SOURCES RELEASE DATE

db:CNVDid:CNVD-2019-34630date:2019-10-10T00:00:00
db:VULHUBid:VHN-158696date:2019-07-02T00:00:00
db:JVNDBid:JVNDB-2019-005914date:2019-07-04T00:00:00
db:CNNVDid:CNNVD-201907-102date:2019-07-02T00:00:00
db:NVDid:CVE-2019-7261date:2019-07-02T18:15:12.080