CVE-2019-7256: Nice (formerly Nortek) Linear eMerge E3-Series Access Controller OS Command Injection

CVE-2019-7256 is a critical OS command injection flaw (CWE-78) in the Linear eMerge E3-Series, a physical access-control panel used to manage building door locks and card readers: an unauthenticated remote attacker can send a crafted request to one of the device's PHP web endpoints and have the operating system execute arbitrary commands with the device's own privileges, and NVD has published its own Primary CVSS v3.1 score of 9.8 (critical) for the flaw.

CVE-2019-7256 (CWE-78, OS command injection) affects the Linear eMerge E3-Series, a browser-managed building access-control system that controls electric door locks, card readers and keypads. NVD's description states plainly: "Linear eMerge E3-Series devices allow Command Injections" (NVD).

NVD lists its own Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full compromise of confidentiality, integrity and availability — a score CISA's ICS-CERT independently submitted as a matching Secondary rating (NVD).

Public proof-of-concept exploits for the specific vulnerable endpoints — card_scan.php and card_scan_decoder.php — have circulated since 2019, documented in NVD's own reference list via multiple Packetstorm Security advisories, and the flaw was originally disclosed by Applied Risk as advisory AR-2019-005 (NVD).

CISA added CVE-2019-7256 to its Known Exploited Vulnerabilities (KEV) catalog on 2024-03-25, naming it the "Nice Linear eMerge E3-Series OS Command Injection Vulnerability" and instructing federal agencies to "contact the vendor for guidance on remediating firmware, per their advisory" (CISA KEV). CISA's SSVC assessment for this CVE records the exploitation state as "active," the attack as "automatable," and the technical impact as "total" (NVD).

The flaw was later folded into CISA's broader advisory ICSA-24-065-01, covering a bundle of eMerge E3 issues (path traversal, cross-site scripting, hard-coded SSH credentials and more) found on the same product line; that advisory's own text for this specific CVE states "Nice Linear eMerge E3-Series versions 1.00-06 and prior are vulnerable to OS command injection, which could allow an attacker to cause remote code execution" (CISA ICS Advisory ICSA-24-065-01). That advisory lists the Commercial Facilities sector with worldwide deployment and recommends minimizing network exposure, placing eMerge devices behind firewalls, using a VPN for any required remote access, and changing default credentials and IP addresses (CISA ICS Advisory ICSA-24-065-01).

FIRST scores the probability of exploitation for CVE-2019-7256 at 0.9708 — the 99.892nd percentile — as of 2026-11-07, consistent with a vulnerability under sustained, automated internet-wide scanning and exploitation (FIRST EPSS).

Any Linear eMerge E3-Series access-control panel running firmware 1.00-06 or earlier should be treated as compromisable by any network-reachable attacker; operators should contact the vendor for current firmware guidance and, in the meantime, remove the device from direct internet exposure and place it behind a firewall with VPN-only remote access.

• Linear eMerge E3-Series devices allow command injection (CWE-78) via their web interface. — NVD
• NVD Primary CVSS v3.1 base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, matched by CISA's Secondary submission; SSVC exploitation status 'active', automatable 'yes', technical impact 'total'. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2024-03-25 as the 'Nice Linear eMerge E3-Series OS Command Injection Vulnerability'; required action is to contact the vendor for firmware remediation guidance. — CISA KEV
• CISA's ICSA-24-065-01 advisory states versions 1.00-06 and prior are vulnerable to OS command injection that 'could allow an attacker to cause remote code execution'; affects Commercial Facilities sector, worldwide deployment; mitigation is network segmentation, firewalling, VPN-only remote access and changing default credentials/IP addresses. — CISA ICS Advisory ICSA-24-065-01
• EPSS score is 0.9708 (99.892nd percentile) as of 2026-11-07. — FIRST EPSS