CVE-2024-9441

Nortek Linear eMerge E3 Pre-Auth RCE PoC (CVE-2024-9441)

Description:

This repository contains a Proof of Concept (PoC) exploit for Nortek Linear eMerge E3 (CVE-2024-9441), which is vulnerable to Remote Code Execution (RCE) in a pre-authentication state. The vulnerability is triggered via a flaw in the password recovery feature, which allows an attacker to inject malicious PHP code into the system, leading to arbitrary code execution.

This PoC allows you to:

• Exploit the vulnerability by sending a crafted request.
• Execute arbitrary commands on the target system.
• Scan multiple targets using a mass scan feature from a list of IPs and ports.
• Perform single target scans using customizable parameters (IP, port, command, etc.).

Vulnerability Details:

• CVE: CVE-2024-9441
• Affected Product: Nortek Linear eMerge E3 (all versions prior to patch)
• Type: Pre-Auth Remote Code Execution
• Attack Vector: HTTP POST request exploiting the password recovery mechanism.

Usage:

Requirements:

• Python 3.x
• requests library ()