Description
There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AutomationDirect | C-MORE EA9 HMI EA9-T6CL | ≤ 6.77 | — |
| AutomationDirect | C-MORE EA9 HMI EA9-T7CL | ≤ 6.77 | — |
| AutomationDirect | C-MORE EA9 HMI EA0-T7CL-R | ≤ 6.77 | — |
| AutomationDirect | C-MORE EA9 HMI EA9-T8CL | ≤ 6.77 | — |
| AutomationDirect | C-MORE EA9 HMI EA9-T10CL | ≤ 6.77 | — |
| AutomationDirect | C-MORE EA9 HMI EA9-T10WCL | ≤ 6.77 | — |
| AutomationDirect | C-MORE EA9 HMI EA9-T12CL | ≤ 6.77 | — |
| AutomationDirect | C-MORE EA9 HMI EA9-T15CL | ≤ 6.77 | — |
| AutomationDirect | C-MORE EA9 HMI EA9-T15CL-R | ≤ 6.77 | — |
| AutomationDirect | C-MORE EA9 HMI EA9-RHMI | ≤ 6.77 | — |
| AutomationDirect | C-MORE EA9 HMI EA9-PGMSW | ≤ 6.77 | — |
Advisories 1
- ICSA-24-086-01 AutomationDirect C-MORE EA9 HMI CISA ICS & IT advisories · Mar 26, 2024
References
- https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 government-resource