CVE-2022-31499

What it actually does

This is an unauthenticated network command-injection vulnerability in Nortek/Linear eMerge E3-Series access-control devices before firmware 0.32-08f. The vulnerable ReaderNo parameter is not safely validated or escaped, allowing attacker-supplied input to be interpreted by the underlying operating system as shell commands. Because exploitation requires no credentials, no user interaction, and can provide full confidentiality, integrity, and availability impact, a successful attacker may execute arbitrary commands on the appliance, inspect or modify configuration and access-control data, create persistence, pivot further into the network, or disrupt physical access-control operations. The issue is described as an incomplete fix for the earlier CVE-2019-7256, so organizations that previously remediated only the older issue should revalidate firmware levels and exposure.

Why it matters to the business

Compromise of an access-control appliance can affect both cybersecurity and physical security operations. An attacker may be able to tamper with door access behavior, disrupt badge-reader services, steal sensitive configuration or credential material, use the appliance as a foothold into adjacent networks, or cause outages affecting building entry. The vulnerability has a critical CVSS score of 9.8, high EPSS likelihood, and weaponized exploit maturity, meaning internet-exposed or poorly segmented devices should be treated as high-priority even though it is not currently listed in CISA KEV. The supplied package fixed-version data for Ubuntu Chromium appears unrelated to the described Nortek eMerge issue and should not be considered remediation for the access-control appliance.

How an attack unfolds

An attacker first identifies a reachable Nortek/Linear eMerge E3-Series web interface, often by scanning for exposed appliance management portals. They then send a crafted HTTP request to the vulnerable card-reader processing functionality with malicious shell metacharacters embedded in the ReaderNo parameter. Because the appliance fails to properly constrain that value, the web application passes attacker-controlled content to the operating system, causing the command to run with the privileges of the affected service. Initial commands commonly validate execution using simple commands such as id, uname, or ping, followed by retrieval of payloads using wget, curl, tftp, or busybox utilities where available. After code execution, the attacker may enumerate files and network settings, alter appliance configuration, add persistence, deploy botnet or proxy tooling, remove traces, or disrupt access-control functions.

How to fix it

Upgrade Nortek/Linear eMerge E3-Series firmware to version 0.32-08f or later, which is the fixed version identified for this issue. If immediate upgrade is not possible, remove the appliance management interface from internet exposure, restrict access to trusted administrative networks or VPNs, apply firewall allowlists, and segment the device from corporate IT networks and other critical systems. Disable unnecessary services and outbound internet access from the appliance where operationally feasible. Because this vulnerability resulted from an incomplete earlier fix, do not rely solely on prior remediation for CVE-2019-7256; confirm the current firmware version explicitly. Treat any unrelated package fixed version such as Ubuntu chromium-browser 66.0.3359.139-0ubuntu0.16.04.3 as not applicable to the described Nortek appliance unless separately required by asset inventory.

How to confirm the fix worked

Confirm that all Nortek/Linear eMerge E3-Series devices are running firmware 0.32-08f or later through the administrative interface, vendor-supported management tooling, or authenticated device inventory. Validate that appliance web management interfaces are not reachable from the public internet and are restricted to approved administrative sources. Perform a safe, non-destructive vulnerability validation using vendor guidance or an approved scanner that checks firmware/build level rather than executing arbitrary commands. Review firewall rules, NAT rules, VPN policies, and external attack-surface management results for exposed eMerge interfaces. After patching, re-run exposure scans and verify that requests containing shell metacharacters in ReaderNo are rejected, sanitized, or produce no command execution side effects.

Typical attack path

1. Scan the internet or internal network for exposed Nortek/Linear eMerge E3-Series web interfaces.
2. Fingerprint the device firmware or web application paths associated with card-reader functionality.
3. Send a crafted unauthenticated HTTP request containing shell metacharacters in the ReaderNo parameter.
4. Confirm command execution through response content, DNS/ICMP callback, or outbound HTTP retrieval.
5. Run reconnaissance commands on the appliance to identify firmware, users, files, network interfaces, and reachable internal systems.
6. Download and execute additional tooling or scripts if outbound access is permitted.
7. Modify configuration, harvest sensitive data, create persistence, or use the appliance as a pivot point.
8. Optionally disrupt access-control service availability or remove logs/artifacts to hinder investigation.

How to detect it

Look for evidence of unauthenticated requests to the eMerge web interface that target card-reader processing paths and include ReaderNo values containing shell metacharacters or encoded command separators. Useful log sources include appliance web/access logs, reverse-proxy logs, firewall logs, VPN logs, IDS/IPS alerts, DNS resolver logs, NetFlow, and any centralized syslog from the access-control network. Search for POST or GET requests to card_scan_decoder.php, card_scan.php, or similar eMerge paths where ReaderNo contains ;, |, &, backticks, $(), newline encodings, or URL-encoded equivalents such as %3B, %7C, %26, %60, %24%28, %0A, or %0D. Also review for command-execution validation strings and payload retrieval attempts such as id, uname, cat /etc/passwd, wget, curl, tftp, busybox, chmod, sh, or /tmp paths in HTTP parameters. On network telemetry, investigate eMerge devices initiating unexpected outbound connections to the internet, especially HTTP downloads, DNS lookups to newly observed domains, ICMP to unfamiliar hosts, or connections to high-risk ports. If device shell or filesystem access is available through vendor-supported forensic procedures, inspect temporary directories, startup scripts, crontabs, modified web files, unknown binaries, and recent configuration changes. Because appliance logging may be limited, absence of local logs should not be treated as proof of non-exploitation; correlate with perimeter and network telemetry.

• card_scan_decoder.php
• card_scan.php
• ReaderNo=
• ReaderNo=%3B
• ReaderNo=;
• ReaderNo=%7C
• ReaderNo=|
• ReaderNo=%26
• ReaderNo=&
• ReaderNo=%60
• ReaderNo=`
• ReaderNo=%24%28
• ReaderNo=$(
• ReaderNo=%0A
• ReaderNo=%0D
• cat%20/etc/passwd
• cat /etc/passwd
• /etc/passwd
• uname%20-a
• uname -a
• wget%20http
• wget http
• curl%20http
• curl http
• tftp%20
• busybox
• chmod%20+x
• chmod +x
• /tmp/
• /var/tmp/
• /bin/sh
• sh%20-c

What your security team should do

• Immediately inventory all Nortek/Linear eMerge E3-Series access-control appliances and identify firmware versions below 0.32-08f.
• Prioritize remediation for any device reachable from the internet, shared networks, vendor remote-access paths, or untrusted internal segments.
• Upgrade affected devices to firmware 0.32-08f or later and preserve configuration backups before maintenance.
• Until upgraded, restrict management access to trusted administrative IP ranges or VPN-only access and block direct internet exposure.
• Review historical web, firewall, proxy, DNS, and network telemetry for exploitation attempts against card_scan_decoder.php or ReaderNo with command-injection metacharacters.
• Investigate any evidence of outbound downloads, unusual DNS lookups, ICMP callbacks, or appliance connections to unknown external hosts.
• If exploitation is suspected, isolate the appliance, collect logs and firmware/configuration artifacts, rotate appliance/admin credentials, and validate physical access-control configuration integrity.
• Coordinate remediation with facilities or physical security teams because patching or isolation may affect door-controller operations.
• Confirm that earlier CVE-2019-7256 remediation did not leave devices vulnerable due to the incomplete-fix condition.