CVE-2024-9441: Unauthenticated RCE in Linear eMerge e3

CVE-2024-9441 is a command injection vulnerability in Linear eMerge e3-Series, physical access control systems. An unauthenticated remote attacker can execute arbitrary OS commands by sending malicious input to the login_id parameter in the forgot_password function, exploitable over HTTP. This class of physical access control is critical in enterprise infrastructure.

The CVSS score is 9.8 (critical). The vulnerability was published on 2024-10-02 on NVD. As of today (2026-10-30), a GitHub signal indicates the existence of public repositories claiming to host exploits: this is an indicator of active research community interest, though not confirmation of active wild exploitation.

For defenders: inventory all Linear eMerge e3-Series systems in production; contact the vendor for patches or security advisories; implement network segmentation to isolate these systems from public networks and untrusted segments; monitor logs for access attempts to the login_id parameter with special characters or command sequences; deploy WAF if available to block malicious input.