CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2024-25138 – AutomationDirect C-MORE EA9 HMI Plaintext Storage of a Password
https://notcve.org/view.php?id=CVE-2024-25138
26 Mar 2024 — In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device. En AutomationDirect C-MORE EA9 HMI, las credenciales utilizadas por la plataforma se almacenan como texto plano en el dispositivo. • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-256: Plaintext Storage of a Password •
CVSS: 5.0EPSS: 0%CPEs: 11EXPL: 0CVE-2024-25137 – AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow
https://notcve.org/view.php?id=CVE-2024-25137
26 Mar 2024 — In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions. En AutomationDirect C-MORE EA9 HMI hay un programa que copia un búfer de un tamaño controlado por el usuario en un búfer de tamaño limitado en la pila, lo que puede provocar un desbordamiento de la pila. El resultado de este desbordamient... • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-121: Stack-based Buffer Overflow •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 0CVE-2024-25136 – AutomationDirect C-MORE EA9 HMI Path Traversal
https://notcve.org/view.php?id=CVE-2024-25136
26 Mar 2024 — There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content. Hay una función en AutomationDirect C-MORE EA9 HMI que permite a un atacante enviar una ruta relativa en la URL sin una sanitización adecuada del contenido. • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 1%CPEs: 13EXPL: 0CVE-2020-10921 – C-MORE HMI EA9 EA-HTTP Missing Authentication for Critical Function Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10921
07 Jul 2020 — This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. • https://www.zerodayinitiative.com/advisories/ZDI-20-807 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2020-10918 – C-MORE HMI EA9 Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-10918
07 Jul 2020 — This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue is due to insufficient authentication on post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from unauthenticated users. • https://www.zerodayinitiative.com/advisories/ZDI-20-805 • CWE-287: Improper Authentication •
CVSS: 5.9EPSS: 0%CPEs: 13EXPL: 0CVE-2020-10919 – C-MORE HMI EA9 Weak Cryptography for Passwords Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-10919
07 Jul 2020 — This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. • https://www.zerodayinitiative.com/advisories/ZDI-20-806 • CWE-261: Weak Encoding for Password CWE-326: Inadequate Encryption Strength •
CVSS: 7.5EPSS: 1%CPEs: 13EXPL: 0CVE-2020-10922 – C-MORE HMI EA9 EA-HTTP Improper Input Validation Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-10922
07 Jul 2020 — This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of proper input validation prior to further processing user requests. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. • https://www.zerodayinitiative.com/advisories/ZDI-20-809 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 13EXPL: 0CVE-2020-10920 – C-MORE HMI EA9 Control Port Missing Authentication for Critical Function Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10920
07 Jul 2020 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the control service, which listens on TCP port 9999 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute code in the context of the device.... • https://www.zerodayinitiative.com/advisories/ZDI-20-808 • CWE-306: Missing Authentication for Critical Function •