PT-2020-12419 · C More · C-More Hmi Ea9 Firmware

Chizuru Toyama + 1 · Published 2020-07-07 · Updated 2020-07-28 · CVE-2020-10918

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions C-MORE HMI EA9 Firmware version 6.52

Description This issue allows remote attackers to bypass authentication on affected installations. The flaw exists within the authentication mechanism due to insufficient authentication on post-authentication requests. An attacker can leverage this to escalate privileges to resources normally protected from unauthenticated users.

Recommendations For C-MORE HMI EA9 Firmware version 6.52, consider temporarily restricting access to the authentication mechanism until a patch is available. As a mitigation measure, review and strengthen the authentication process for post-authentication requests to prevent privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-10918

ZDI-20-805

Affected Products

C-More Hmi Ea9 Firmware

References · 4

• https://zerodayinitiative.com/advisories/ZDI-20-805 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10918 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10918 · Security Note
• https://t.me/cibsecurity/13631 · Telegram Post