CVE-2020-6969

Published: Feb 5, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More Touch Panels EA9 series: firmware versions prior to 6.53 and manipulate system configurations.

Affected (11)

Products: Automationdirect: C More Ea9 Rhi Firmware, C More Ea9 T6cl R Firmware, C More Ea9 T6cl Firmware, C More Ea9 T7cl R Firmware, C More Ea9 T7cl Firmware, C More Ea9 T8cl Firmware, C More Ea9 T10cl Firmware, C More Ea9 T10wcl Firmware, C More Ea9 T12cl Firmware, C More Ea9 T15cl R Firmware, C More Ea9 T15cl Firmware

Automationdirect

11 products

C More Ea9 Rhi Firmware

C More Ea9 T6cl R Firmware

C More Ea9 T6cl Firmware

C More Ea9 T7cl R Firmware

C More Ea9 T7cl Firmware

C More Ea9 T8cl Firmware

C More Ea9 T10cl Firmware

C More Ea9 T10wcl Firmware

C More Ea9 T12cl Firmware

C More Ea9 T15cl R Firmware

C More Ea9 T15cl Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C More Ea9 Rhi Firmware	Before 6.53

Running on/with	Platform Versions
Automationdirect C More Ea9 Rhi	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C More Ea9 T6cl R Firmware	Before 6.53

Running on/with	Platform Versions
Automationdirect C More Ea9 T6cl R	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C More Ea9 T6cl Firmware	Before 6.53

Running on/with	Platform Versions
Automationdirect C More Ea9 T6cl	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C More Ea9 T7cl R Firmware	Before 6.53

Running on/with	Platform Versions
Automationdirect C More Ea9 T7cl R	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C More Ea9 T7cl Firmware	Before 6.53

Running on/with	Platform Versions
Automationdirect C More Ea9 T7cl	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C More Ea9 T8cl Firmware	Before 6.53

Running on/with	Platform Versions
Automationdirect C More Ea9 T8cl	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C More Ea9 T10cl Firmware	Before 6.53

Running on/with	Platform Versions
Automationdirect C More Ea9 T10cl	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C More Ea9 T10wcl Firmware	Before 6.53

Running on/with	Platform Versions
Automationdirect C More Ea9 T10wcl	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C More Ea9 T12cl Firmware	Before 6.53

Running on/with	Platform Versions
Automationdirect C More Ea9 T12cl	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C More Ea9 T15cl R Firmware	Before 6.53

Running on/with	Platform Versions
Automationdirect C More Ea9 T15cl R	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C More Ea9 T15cl Firmware	Before 6.53

Running on/with	Platform Versions
Automationdirect C More Ea9 T15cl	All versions

Related CWEs

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (2)

https://www.us-cert.gov/ics/advisories/icsa-20-035-01

Source: ics-cert@hq.dhs.gov

PatchThird Party AdvisoryUS Government Resource

https://www.us-cert.gov/ics/advisories/icsa-20-035-01

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party AdvisoryUS Government Resource

Timeline

No history available yet.