Vulnerability Note VU#571629
S2 Security Netbox/Linear eMerge Access Control System management component vulnerable to unauthenticated factory reset
The S2 Security Netbox/Linear eMerge Access Control System management console allows an unauthenticated attacker to perform a factory reset of the management system.
Linear eMerge is an IP-enabled security management and access control system. The product is distributed by Linear LLC, however the product is created by the S2 Security Corporation. Linear eMerge has two types of components. The first is a Linux system that runs a web server and a database. This component is used to configure the access control system through the use of a web browser. The other component are the node controls, which operate building security hardware, such as locks, card readers, elevator buttons, motion detectors, etc.
The management component of eMerge can be reset to its factory configuration through the use of a specially crafted URI. No authentication is required. Once this happens, the management component will no longer be functional and will be taken off of the network because it will lose its IP address. If this happens, the node components will continue to operate, but in a standalone configuration. The nodes can continue to operate in this manner indefinitely.
By following a specially crafted URI, a local, unauthenticated attacker can cause a denial-of-service condition on the eMerge management controller. Note that this condition does not affect the operation of the node components.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Linear LLC||Affected||21 Oct 2009||26 Jul 2010|
|S2 Security||Affected||28 Oct 2009||26 Jul 2010|
CVSS Metrics (Learn More)
Thanks to Shawn Merdinger for reporting this vulnerability.
This document was written by Will Dormann.
- CVE IDs: CVE-2009-3734
- Date Public: 04 Jan 2010
- Date First Published: 04 Jan 2010
- Date Last Updated: 26 Jul 2010
- Severity Metric: 0.25
- Document Revision: 21
If you have feedback, comments, or additional information about this vulnerability, please send us email.