CVE-2020-10918

Published: Jul 23, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue is due to insufficient authentication on post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from unauthenticated users. Was ZDI-CAN-10182.

Affected (1)

Products: Automationdirect: C More Hmi Ea9 Firmware

Automationdirect

1 product

C More Hmi Ea9 Firmware

Configuration A

1 vulnerable · 12 platform

Vulnerable Software	Affected Versions
Automationdirect C More Hmi Ea9 Firmware	Version 6.52

Running on/with	Platform Versions
Automationdirect Ea9 Pgmsw	All versions
Automationdirect Ea9 Rhmi	All versions
Automationdirect Ea9 T10cl	All versions
Automationdirect Ea9 T10wcl	All versions
Automationdirect Ea9 T12cl	All versions
Automationdirect Ea9 T15cl	All versions
Automationdirect Ea9 T15cl R	All versions
Automationdirect Ea9 T6cl	All versions
Automationdirect Ea9 T6cl R	All versions
Automationdirect Ea9 T7cl	All versions
Automationdirect Ea9 T7cl R	All versions
Automationdirect Ea9 T8cl	All versions

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://www.zerodayinitiative.com/advisories/ZDI-20-805/

Source: zdi-disclosures@trendmicro.com

Third Party AdvisoryVDB Entry

https://www.zerodayinitiative.com/advisories/ZDI-20-805/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.