CVSS: 9.8EPSS: 0%CPEs: 40EXPL: 0CVE-2021-32986 – Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
https://notcve.org/view.php?id=CVE-2021-32986
04 Apr 2022 — After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout. If the programming software is interrupted, the PLC remains unlocked. All subsequent programming connections are allowed without authorization. The PLC is only relocked by a power cycle, or when the programming software disconnects correctly. Después de los módulos de CPU del PLC CLICK de Automation Direct: C0-1x con versiones de firmware anteriores a... • https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02 • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 0%CPEs: 40EXPL: 0CVE-2021-32984 – Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
https://notcve.org/view.php?id=CVE-2021-32984
04 Apr 2022 — All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, an attacker can connect to the PLC and read the project without authorization. Todas las conexiones de programación reciben los mismos privilegios desbloqueados, lo que puede resultar en una escalada de privilegios. Durante el tiempo que los Módulos de CPU de PLC CLICK ... • https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02 • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 7.5EPSS: 0%CPEs: 40EXPL: 0CVE-2021-32978 – Automation Direct CLICK PLC CPU Modules Plaintext Storage of a Password
https://notcve.org/view.php?id=CVE-2021-32978
04 Apr 2022 — The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00. El protocolo de programación permite que un atacante lea la contraseña introducida previamente y el estado de bloqueo. Si la contraseña introducida previamente fue satisfactoria, el atacante puede usar la contraseña para d... • https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02 • CWE-256: Plaintext Storage of a Password CWE-522: Insufficiently Protected Credentials •
CVSS: 9.8EPSS: 0%CPEs: 40EXPL: 0CVE-2021-32980 – Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
https://notcve.org/view.php?id=CVE-2021-32980
04 Apr 2022 — Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active. Módulos de CPU del PLC CLICK de Automation Direct: Las CPUs C0-1x con firmware versiones anteriores a v3.00, no protegen contra conexiones de programación de software adicionales. Un atacante puede conectarse al PLC mientras una conexión presente ya está activa • https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02 • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 9.8EPSS: 1%CPEs: 13EXPL: 0CVE-2020-10921 – C-MORE HMI EA9 EA-HTTP Missing Authentication for Critical Function Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10921
07 Jul 2020 — This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. • https://www.zerodayinitiative.com/advisories/ZDI-20-807 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2020-10918 – C-MORE HMI EA9 Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-10918
07 Jul 2020 — This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue is due to insufficient authentication on post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from unauthenticated users. • https://www.zerodayinitiative.com/advisories/ZDI-20-805 • CWE-287: Improper Authentication •
CVSS: 5.9EPSS: 0%CPEs: 13EXPL: 0CVE-2020-10919 – C-MORE HMI EA9 Weak Cryptography for Passwords Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-10919
07 Jul 2020 — This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. • https://www.zerodayinitiative.com/advisories/ZDI-20-806 • CWE-261: Weak Encoding for Password CWE-326: Inadequate Encryption Strength •
CVSS: 7.5EPSS: 1%CPEs: 13EXPL: 0CVE-2020-10922 – C-MORE HMI EA9 EA-HTTP Improper Input Validation Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-10922
07 Jul 2020 — This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of proper input validation prior to further processing user requests. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. • https://www.zerodayinitiative.com/advisories/ZDI-20-809 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 13EXPL: 0CVE-2020-10920 – C-MORE HMI EA9 Control Port Missing Authentication for Critical Function Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10920
07 Jul 2020 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the control service, which listens on TCP port 9999 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute code in the context of the device.... • https://www.zerodayinitiative.com/advisories/ZDI-20-808 • CWE-306: Missing Authentication for Critical Function •
CVSS: 10.0EPSS: 0%CPEs: 22EXPL: 0CVE-2020-6969
https://notcve.org/view.php?id=CVE-2020-6969
05 Feb 2020 — It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More Touch Panels EA9 series: firmware versions prior to 6.53 and manipulate system configurations. Es posible desenmascarar credenciales y otra información confidencial en archivos de proyecto "desprotegidos", lo que puede permitir a un atacante acceder de forma remota a la serie EA9 de C-More Touch Panels: versiones de firmware anteriores a la versión 6.... • https://www.us-cert.gov/ics/advisories/icsa-20-035-01 • CWE-522: Insufficiently Protected Credentials •