CVE-2020-10921

Published: Jul 23, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. Was ZDI-CAN-10482.

Affected (1)

Products: Automationdirect: C More Hmi Ea9 Firmware

Automationdirect

1 product

C More Hmi Ea9 Firmware

Configuration A

1 vulnerable · 12 platform

Vulnerable Software	Affected Versions
Automationdirect C More Hmi Ea9 Firmware	Version 6.52

Running on/with	Platform Versions
Automationdirect Ea9 Pgmsw	All versions
Automationdirect Ea9 Rhmi	All versions
Automationdirect Ea9 T10cl	All versions
Automationdirect Ea9 T10wcl	All versions
Automationdirect Ea9 T12cl	All versions
Automationdirect Ea9 T15cl	All versions
Automationdirect Ea9 T15cl R	All versions
Automationdirect Ea9 T6cl	All versions
Automationdirect Ea9 T6cl R	All versions
Automationdirect Ea9 T7cl	All versions
Automationdirect Ea9 T7cl R	All versions
Automationdirect Ea9 T8cl	All versions

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://www.zerodayinitiative.com/advisories/ZDI-20-807/

Source: zdi-disclosures@trendmicro.com

Third Party AdvisoryVDB Entry

https://www.zerodayinitiative.com/advisories/ZDI-20-807/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.