CVE-2024-9441 Nice CVE debrief

Who should care

Security and operations teams responsible for Nice Linear eMerge E3 deployments, especially facilities, physical access control, OT/ICS, and network teams. This is most urgent for devices that are reachable over HTTP, exposed beyond a trusted management network, or managed by third parties.

Technical summary

CISA’s CSAF advisory ICSA-25-114-04 identifies an OS command injection issue in Nice Linear eMerge E3 through 1.00-07. The issue is reachable over HTTP through the forgot_password function, where the login_id parameter can be abused by an unauthenticated remote attacker to trigger arbitrary OS command execution. The supplied CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting high impact and no authentication or user interaction requirements. The advisory does not state a vendor patch timeline, and instead emphasizes network isolation and other defensive controls.

Defensive priority

Urgent. Because the flaw is network-reachable, unauthenticated, and allows arbitrary command execution on an access-control/OT device, exposed instances should be treated as high risk and isolated immediately until mitigations are in place.

Recommended defensive actions

• Inventory all Nice Linear eMerge E3 devices and confirm whether any are running version 1.00-07 or earlier.
• Minimize network exposure of the devices and ensure they are not accessible from the internet.
• Place the devices behind firewalls and isolate them from other networks.
• If remote access is required, use secure methods such as a VPN and keep VPN software up to date.
• Change default credentials on the device.
• Change the device’s default IP address where applicable.
• Review Nice’s E3-Bulletin and related Telephone Entry Bulletin for the latest product security guidance.
• Contact Nice for vendor guidance and monitor for a fixed release or further advisory updates.

Evidence notes

All substantive claims are grounded in the supplied CISA CSAF source item for ICSA-25-114-04 and its cited remediation text. The advisory states that Linear eMerge e3-Series through version 1.00-07 is vulnerable to OS command injection via the login_id parameter in forgot_password over HTTP, and that the issue affects remote, unauthenticated attackers. The source item shows initial publication on 2025-04-24 and a revision on 2025-05-06 with typo fixes only. The supplier notes do not provide a patch date, and the remediation section emphasizes exposure reduction and defensive controls.

Official resources