CVE-2019-7256

What is Linear eMerge E3?

Linear eMerge E3-Series (now under Nice) is a physical access-control system used to manage door locks, badge readers, and building entry systems in commercial facilities. Its web-based management interface is sometimes exposed directly to the internet for remote administration, making compromise of the device a path to physically unlocking doors or pivoting into a building's network.

Overview

CVE-2019-7256 is a critical (CVSS 9.8) OS command injection vulnerability (CWE-78) in the eMerge E3 web management interface, allowing an unauthenticated remote attacker to execute arbitrary operating system commands. Despite being disclosed in 2019, it was not added to the CISA KEV catalog until March 2024, after evidence emerged of active exploitation years after public disclosure — a pattern common with internet-exposed building/OT systems that are rarely patched.

Technical Details

The E3 web interface passes user-supplied input to a system-level function without adequate sanitization, letting an attacker embed shell metacharacters or commands inside a request parameter that the underlying OS then executes. Because it requires no authentication, no user interaction, and can be triggered with a single crafted HTTP request, it is trivial to weaponize.

Discovery

Pre-authentication vulnerabilities in Linear eMerge E3 devices, including this command injection, were identified by industrial-control-system security researchers and disclosed through CISA's ICS coordinated disclosure process, culminating in advisory ICSA-24-065-01.

Exploitation Context

CISA added this CVE to the KEV catalog in March 2024 citing confirmed active exploitation, despite the flaw having been publicly known since 2019 — evidence that internet-exposed physical access-control systems remain attractive, long-lived targets. The vendor's guidance points administrators to a security bulletin rather than a straightforward firmware patch, meaning many affected devices likely remain vulnerable.

Remediation

1. Consult Nice/Linear's E3 security bulletin (linked above) for current mitigation and firmware guidance.
2. Remove eMerge E3 management interfaces from direct internet exposure — restrict access to a management VLAN or VPN.
3. Segment physical-access-control systems from general corporate IT networks.
4. Monitor device logs for unexpected command execution or configuration changes.
5. If the device cannot be patched or isolated, consider replacement, given its extended history of unpatched pre-auth vulnerabilities.