Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
2/3/2020
04:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attackers Actively Targeting Flaw in Door-Access Controllers

There's been a sharp increase in scans for vulnerable Nortek Linear Emerge E3 systems, SonicWall says.

Attackers are actively trying to exploit a critical, previously disclosed command injection flaw in a door access-controller system from Nortek Security and Control LLC to use the device to launch distributed denial-of-service attacks (DDoS).

SonicWall, which reported on the threat Saturday, said its researchers have observed attackers scanning the entire IPv4 address range space for the vulnerable systems in recent days. According to the security vendor, its firewalls have been blocking literally tens of thousands of hits daily from some 100 IP addresses around the world that are doing the scanning.

The command injection vulnerability [CVE-2019-7256] exists in products from Nortek's Linear eMerge E3 Series access-controller family running older versions of a particular firmware. The access controllers allow organizations to specify the doors that personnel and others can use to enter and exit designated areas within a building or facility, based on their access rights.

Organizations in multiple industries currently use Nortek's access controllers, including commercial, industrial, banking, medical, and the retail sector.

The injection flaw was among several vulnerabilities in Nortek's Linear eMerge E3 Series family that industrial cybersecurity firm Applied Risk disclosed in May 2019. The company at the time described the flaw as allowing attackers to execute commands of their choice directly on the operating system.

The flaw has a CVSS score of 10, which is the maximum possible severity rating for any vulnerability. The issue is considered especially dangerous because it allows an unauthenticated attacker to gain complete remote control of the system.

According to a description of the flaw on CVE Details, the flaw enables complete information disclosure, complete compromise of system integrity, and complete compromise of system availability. It is also considered relatively easy to exploit with no specialized access conditions or extenuating circumstances required to exploit the flaw.

Applied Risk described Nortek as being aware of the issue but not issuing a patch for it. So in November it released proof-of-concept code demonstrating how an attacker could exploit the vulnerability to take complete control of a vulnerable system. A SonicWall spokesman says a patch for the issue still does not appear to be available.

DoS Attacks & More

Nortek did not immediately respond to a request for comment sent to its general customer service inquiry email address.

In a report Saturday, SonicWall said attackers have been trying to exploit the vulnerability using a specific HTTP request. Once exploited, shell commands are used to download malware for conducting various types of denial-of-service attacks, the vendor said.

In addition to launching DDoS attacks from devices exploited with the vuln, bad actors can exploit the flaw in other ways, the SonicWall spokeswoman says. OS command injection flaws give attackers a way to compromise other parts of the infrastructure, she notes. "Since the attacker is able to download and run code on the target systems, they hypothetically 'own' them."

SonicWall quoted Applied Risk as estimating the number of vulnerable Internet-accessible eMerge E3 systems at around 2,375. But the vulnerabilities disclosed in the Applied Risk report potentially impacts thousands more devices, the SonicWall spokesman says. "Also, over four million personal identifiable records could be leaked revealing information such as names or email addresses of people owning cards for these door locks," she notes.

Organizations with these door controllers for their buildings can take a couple of measures to mitigate their exposure. The first is to ensure that vulnerable controllers are not accessible over the Internet nor discoverable via search engines such as Shodan, the SonicWall spokesman says.

Organizations should also segment off access to the vulnerable controllers from internal networks. "A random person inside the company should not be on the same network as the controllers," he notes. They should also consider using IPS systems to virtually patch against the exploits until a fix becomes available, he says.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "AppSec Concerns Drove 61% of Businesses to Change Applications."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21510
PUBLISHED: 2021-03-08
Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary ‘Host’ header values to poison a web-cache or trigger redirections.
CVE-2020-27575
PUBLISHED: 2021-03-08
Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation.
CVE-2020-27576
PUBLISHED: 2021-03-08
Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS). Users are able to create folders in the web application. The folder name is insufficiently validated resulting in a stored cross-site scripting vulnerability.
CVE-2020-27838
PUBLISHED: 2021-03-08
A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulner...
CVE-2021-21503
PUBLISHED: 2021-03-08
PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in a command. The Compadmin user could potentially exploit this vulnerability, leading to potential privileges escalation.