PT-2020-12422 · C More · C-More Ea9 Hmi

Chizuru Toyama + 1 · Published 2020-07-07 · Updated 2020-08-10 · CVE-2020-10921

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions C-MORE HMI EA9 Firmware version 6.52

Description This issue allows remote attackers to issue commands on affected installations without requiring authentication. The flaw exists within the EA-HTTP.exe process due to the lack of authentication prior to allowing system configuration alterations. An attacker can leverage this to issue commands to the physical equipment controlled by the device.

Recommendations For C-MORE HMI EA9 Firmware version 6.52, consider disabling the EA-HTTP.exe process until a patch is available to prevent exploitation. Restrict access to the system configuration to minimize the risk of unauthorized alterations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-10921

ZDI-20-807

Affected Products

C-More Ea9 Hmi

References · 4

• https://zerodayinitiative.com/advisories/ZDI-20-807 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-10921 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10921 · Vendor Advisory
• https://t.me/cibsecurity/13628 · Telegram Post