FortiGuard Outbreak Alert: Nice Linear eMerge Command Injection Vulnerability

Nice Linear eMerge E3-Series is an access control system that is widely used in many environments.

The OS has a command injection vulnerability that allows attackers to perform remote code execution. 

Impacted E3 controller models include E3 Essentials, E3 Elite, E3 Enterprise (ProControl)

CVE ID

CVE-2019-7256 (https://nvd.nist.gov/vuln/detail/CVE-2019-7256) 

Playbook

Threat hunting 

FortiNDR Cloud users can use the following IOCs from Fortinet to hunt for “Nice Linear eMerge Command Injection Vulnerability” related activities  
IOC source: https://www.fortiguard.com/outbreak-ioc?tag=nice%20linear%20emerge%20attack

Suricata Coverage 

Customers can create custom investigation/detections using the Suricata signatures below 
2029207 → ET EXPLOIT Linear eMerge E3 Unauthenticated Command Injection Inbound (CVE-2019-7256) 

2029213 → ET EXPLOIT Linear eMerge E3 Unauthenticated Command Injection Outbound (CVE-2019-7256) 

2033757 → ET EXPLOIT eMerge E3 Command Injection Inbound (CVE-2019-7256) 

Other Fortinet Products

For more details regarding mitigating the vulnerability by utilizing Fortinet products, please refer to  
https://www.fortiguard.com/outbreak-alert/nice-linear-emerge-attack