High ICSA-24-086-01 3 CVEs

AutomationDirect C-MORE EA9 HMI

Published Mar 26, 2024 · Updated Mar 26, 2024

Vendor: Automation Direct Product: C-MORE EA9 HMI EA0-T7CL-R Product: C-MORE EA9 HMI EA9-PGMSW Product: C-more EA9 HMI EA9-RHMI Product: C-more EA9 HMI EA9-T10CL Product: C-more EA9 HMI EA9-T10WCL Product: C-more EA9 HMI EA9-T12CL Product: C-more EA9 HMI EA9-T15CL Product: C-more EA9 HMI EA9-T15CL-R Product: C-more EA9 HMI EA9-T6CL Product: C-more EA9 HMI EA9-T7CL Product: C-more EA9 HMI EA9-T8CL

Summary

Successful exploitation of these vulnerabilities could allow an attacker to exploit a remote device and inject malicious code on the panel.

Vulnerabilities 3

High 7.5

CVE-2024-25136

AutomationDirect C-MORE EA9 HMI Path Traversal

There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content.

Automation Direct C-more EA9 HMI EA9-T12CL C-more EA9 HMI EA9-T15CL C-more EA9 HMI EA9-T6CL

Mar 26, 2024
Medium 6.5

CVE-2024-25138

AutomationDirect C-MORE EA9 HMI Plaintext Storage of a Password

In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device.

Automation Direct C-more EA9 HMI EA9-T7CL C-more EA9 HMI EA9-T10CL C-more EA9 HMI EA9-T12CL

Mar 26, 2024
Medium 4.3

CVE-2024-25137

AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow

In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-servi…

Automation Direct C-more EA9 HMI EA9-T15CL-R C-more EA9 HMI EA9-RHMI C-more EA9 HMI EA9-T7CL

Mar 26, 2024

Revision history

2024-03-26 #1
Initial Publication

References

ICSA Advisory ICSA-24-086-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B