CVSS: 10.0EPSS: 0%CPEs: 10EXPL: 0CVE-2025-0960 – AutomationDirect C-more EA9 HMI Classic Buffer Overflow
https://notcve.org/view.php?id=CVE-2025-0960
04 Feb 2025 — AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an attacker abusing the function to cause a denial-of-service condition or achieving remote code execution on the affected device. • https://community.automationdirect.com/s/cybersecurity/security-advisories • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2024-25138 – AutomationDirect C-MORE EA9 HMI Plaintext Storage of a Password
https://notcve.org/view.php?id=CVE-2024-25138
26 Mar 2024 — In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device. En AutomationDirect C-MORE EA9 HMI, las credenciales utilizadas por la plataforma se almacenan como texto plano en el dispositivo. • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-256: Plaintext Storage of a Password •
CVSS: 5.0EPSS: 0%CPEs: 11EXPL: 0CVE-2024-25137 – AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow
https://notcve.org/view.php?id=CVE-2024-25137
26 Mar 2024 — In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions. En AutomationDirect C-MORE EA9 HMI hay un programa que copia un búfer de un tamaño controlado por el usuario en un búfer de tamaño limitado en la pila, lo que puede provocar un desbordamiento de la pila. El resultado de este desbordamient... • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-121: Stack-based Buffer Overflow •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 0CVE-2024-25136 – AutomationDirect C-MORE EA9 HMI Path Traversal
https://notcve.org/view.php?id=CVE-2024-25136
26 Mar 2024 — There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content. Hay una función en AutomationDirect C-MORE EA9 HMI que permite a un atacante enviar una ruta relativa en la URL sin una sanitización adecuada del contenido. • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 24EXPL: 0CVE-2022-2006 – AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element
https://notcve.org/view.php?id=CVE-2022-2006
31 Aug 2022 — AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 24EXPL: 0CVE-2022-2005 – AutomationDirect C-more EA9 HMI Cleartext Transmission
https://notcve.org/view.php?id=CVE-2022-2005
31 Aug 2022 — AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL version... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.8EPSS: 1%CPEs: 13EXPL: 0CVE-2020-10921 – C-MORE HMI EA9 EA-HTTP Missing Authentication for Critical Function Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10921
07 Jul 2020 — This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. • https://www.zerodayinitiative.com/advisories/ZDI-20-807 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2020-10918 – C-MORE HMI EA9 Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-10918
07 Jul 2020 — This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue is due to insufficient authentication on post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from unauthenticated users. • https://www.zerodayinitiative.com/advisories/ZDI-20-805 • CWE-287: Improper Authentication •
CVSS: 5.9EPSS: 0%CPEs: 13EXPL: 0CVE-2020-10919 – C-MORE HMI EA9 Weak Cryptography for Passwords Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-10919
07 Jul 2020 — This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. • https://www.zerodayinitiative.com/advisories/ZDI-20-806 • CWE-261: Weak Encoding for Password CWE-326: Inadequate Encryption Strength •
CVSS: 7.5EPSS: 1%CPEs: 13EXPL: 0CVE-2020-10922 – C-MORE HMI EA9 EA-HTTP Improper Input Validation Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-10922
07 Jul 2020 — This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of proper input validation prior to further processing user requests. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. • https://www.zerodayinitiative.com/advisories/ZDI-20-809 • CWE-20: Improper Input Validation •