Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting (XSS) vulnerability which is chained with a local session fixation. This vulnerability allows attackers to escalate privileges via unspecified vectors.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Linear_emerge_e3_access_control_firmware | Niceforyou | 0.32-07e (including) | 0.32-07e (including) |
| Linear_emerge_e3_access_control_firmware | Niceforyou | 0.32-07p (including) | 0.32-07p (including) |
| Linear_emerge_e3_access_control_firmware | Niceforyou | 0.32-08e (including) | 0.32-08e (including) |
| Linear_emerge_e3_access_control_firmware | Niceforyou | 0.32-08f (including) | 0.32-08f (including) |
| Linear_emerge_e3_access_control_firmware | Niceforyou | 0.32-09a (including) | 0.32-09a (including) |
| Linear_emerge_e3_access_control_firmware | Niceforyou | 0.32-09b (including) | 0.32-09b (including) |
| Linear_emerge_e3_access_control_firmware | Niceforyou | 0.32-09c (including) | 0.32-09c (including) |
Such a scenario is commonly observed when: