PT-2020-12421 · C More · C-More Hmi Ea9 Firmware

Chizuru Toyama + 1 · Published 2020-07-07 · Updated 2020-07-28 · CVE-2020-10920

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions C-MORE HMI EA9 Firmware version 6.52

Description This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the control service, which listens on TCP port 9999 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this issue to execute code in the context of the device.

Recommendations For C-MORE HMI EA9 Firmware version 6.52, consider disabling the control service that listens on TCP port 9999 until a patch is available. Restrict access to the control service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-10920

ZDI-20-808

Affected Products

C-More Hmi Ea9 Firmware

References · 4

• https://zerodayinitiative.com/advisories/ZDI-20-808 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10920 · Security Note
• https://t.me/cibsecurity/13629 · Telegram Post