CVSS: 7.8EPSS: 0%CPEs: 24EXPL: 0CVE-2022-2006 – AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element
https://notcve.org/view.php?id=CVE-2022-2006
31 Aug 2022 — AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 24EXPL: 0CVE-2022-2005 – AutomationDirect C-more EA9 HMI Cleartext Transmission
https://notcve.org/view.php?id=CVE-2022-2005
31 Aug 2022 — AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL version... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.8EPSS: 1%CPEs: 13EXPL: 0CVE-2020-10921 – C-MORE HMI EA9 EA-HTTP Missing Authentication for Critical Function Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10921
07 Jul 2020 — This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. • https://www.zerodayinitiative.com/advisories/ZDI-20-807 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2020-10918 – C-MORE HMI EA9 Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-10918
07 Jul 2020 — This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue is due to insufficient authentication on post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from unauthenticated users. • https://www.zerodayinitiative.com/advisories/ZDI-20-805 • CWE-287: Improper Authentication •
CVSS: 5.9EPSS: 0%CPEs: 13EXPL: 0CVE-2020-10919 – C-MORE HMI EA9 Weak Cryptography for Passwords Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-10919
07 Jul 2020 — This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. • https://www.zerodayinitiative.com/advisories/ZDI-20-806 • CWE-261: Weak Encoding for Password CWE-326: Inadequate Encryption Strength •
CVSS: 7.5EPSS: 1%CPEs: 13EXPL: 0CVE-2020-10922 – C-MORE HMI EA9 EA-HTTP Improper Input Validation Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-10922
07 Jul 2020 — This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of proper input validation prior to further processing user requests. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. • https://www.zerodayinitiative.com/advisories/ZDI-20-809 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 13EXPL: 0CVE-2020-10920 – C-MORE HMI EA9 Control Port Missing Authentication for Critical Function Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10920
07 Jul 2020 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the control service, which listens on TCP port 9999 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute code in the context of the device.... • https://www.zerodayinitiative.com/advisories/ZDI-20-808 • CWE-306: Missing Authentication for Critical Function •