Latest Automation Direct vulnerabilities #
Automation Direct has disclosed multiple vulnerabilities in their C-MORE EA9 HMI product.
CVE-2024-11609, CVE-2024-11610, and CVE-2024-11611 are all rated high with CVSS score of 8.4 and allows an attacker to execute arbitrary code remotely by uploading a specially crafted file to trigger a stack-based buffer overflow during file parsing and/or cause memory corruption to which could lead to complete system compromise.
What is the impact? #
Successful exploitation of these vulnerabilities could result in memory corruption; a buffer overflow condition may allow remote code execution.
Are updates or workarounds available? #
Automation Direct recommends that users update C-MORE EA9 HMI to V6.79. Additionally, users should ensure these devices are not accessible from the public internet and ensure they are properly firewalled within business networks and accessible through properly configured VPN software.
How do I find potentially vulnerable systems with runZero? #
From the Service Inventory, use the following query to locate systems running potentially vulnerable software:
protocol:ftp AND banner:"EA9-"From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:
hw:"C-MORE%"We recommend running both queries to ensure all assets can be identified to take appropriate action.
March 28th, 2024 vulnerabilities #
Automation Direct has disclosed multiple vulnerabilities in their C-MORE EA9 HMI product.
CVE-2024-25136 is rated high with CVSS score of 7.5 and allows an attacker to send a relative path in the URL without proper sanitizing.
CVE-2024-25138 is rated medium with a CVSS score of 6.5 and indicates credentials used by the platform are stored as plain text on the device.
CVE-2024-25137 is rated medium with a CVSS score of 4.3 and indicates the program accepts user supplied data that is copied into a fixed stack buffer causing an overflow and leading to denial-of-service conditions.
What was the impact? #
Successful exploitation of these vulnerabilities would allow an attacker to create a denial-of-service condition, or access sensitive resources without authorization.
Are updates or workarounds available? #
Automation Direct recommends that users update C-MORE EA9 HMI to V6.78. Additionally, users should ensure these devices are not accessible from the public internet and ensure they are properly firewalled within business networks and accessible through properly configured VPN software.
How do I find potentially vulnerable systems with runZero? #
From the Service Inventory, use the following query to locate systems running potentially vulnerable software:
protocol:ftp AND banner:"EA9-"From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:
hw:"C-MORE%"We recommend running both queries to ensure all assets can be identified to take appropriate action.
