CVE-2019-7269

CRITICAL

Linear eMerge 50P/5000P - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-7269. PoCs published by LiquidWorm.

AI-analyzed exploit summary This exploit leverages multiple vulnerabilities (CVE-2019-7266, CVE-2019-7267, CVE-2019-7268, CVE-2019-7269) in Linear eMerge50P/5000P 4.6.07 to achieve unauthenticated remote code execution and privilege escalation to root. It exploits session ID path traversal, unauthenticated file upload, and a webserver running as root.

Description

Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.

Exploits (1)

exploitdb WORKING POC
by LiquidWorm · bashwebappshardware
https://www.exploit-db.com/exploits/47624

This exploit leverages multiple vulnerabilities (CVE-2019-7266, CVE-2019-7267, CVE-2019-7268, CVE-2019-7269) in Linear eMerge50P/5000P 4.6.07 to achieve unauthenticated remote code execution and privilege escalation to root. It exploits session ID path traversal, unauthenticated file upload, and a webserver running as root.

Classification
Working Poc 95%
Attack Type
Rce | Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linear eMerge50P/5000P 4.6.07
No auth needed
Prerequisites: Network access to the target device · Target device must be running Linear eMerge50P/5000P 4.6.07
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Broken Link, Not Applicable, Third Party Advisory x_refsource_misc
https://applied-risk.com/labs/advisories
Third Party Advisory x_refsource_misc
https://www.applied-risk.com/resources/ar-2019-006
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-20-184-01

Scores

CVSS v3 9.8
EPSS 0.4001
EPSS Percentile 98.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
nortekcontrol/linear_emerge_5000p_firmware < 4.6.07
nortekcontrol/linear_emerge_50p_firmware < 4.6.07
Published Jul 02, 2019
Tracked Since Feb 18, 2026