PT-2022-20657 · Nortek Linear · Emerge E3-Series

Omarhashem123 · CVE-2022-31269 · Published 2022-08-25 · Updated 2022-09-02

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nortek Linear eMerge E3-Series devices versions 0.32-09c and earlier

Description The issue allows an attacker to obtain admin credentials stored in /test.txt, which can be used to open a building's doors. This occurs even when default credentials have been changed.

Recommendations For versions 0.32-09c and earlier, remove or restrict access to the /test.txt file to prevent exposure of admin credentials. Consider changing admin credentials and limiting access to the device to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-31269

Affected Products

Emerge E3-Series

References · 7

• 🔥 http://packetstormsecurity.com/files/167990/Nortek-Linear-eMerge-E3-Series-Credential-Disclosure.html · Exploit
• 🔥 https://gist.github.com/omarhashem123/71ec9223e90ea76a76096d777d9b945c · Exploit
• https://osv.dev/vulnerability/CVE-2022-31269 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31269 · Security Note
• https://nortekcontrol.com/access-control · Note
• https://eg.linkedin.com/in/omar-1-hashem · Note
• https://t.me/cvenotify/35659 · Telegram Post