CVE-2024-25136 - AutomationDirect C-MORE EA9 HMI Path Traversal

Back Back to CVE browser

HIGH

AutomationDirect C-MORE EA9 HMI Path Traversal

Published Mar 26, 2024

7.5

HIGH

CVSS 3.1

EPSS 0.62%

Description

There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content.

Affected products

Vendor AutomationDirect Product C-More Ea9 Hmi Ea0-T7cl-R Default
unaffected
Affected
- ≥ 0, ≤ 6.77
Vendor AutomationDirect Product C-More Ea9 Hmi Ea9-Pgmsw Default
unaffected
Affected
- ≥ 0, ≤ 6.77
Vendor AutomationDirect Product C-More Ea9 Hmi Ea9-Rhmi Default
unaffected
Affected
- ≥ 0, ≤ 6.77
Vendor AutomationDirect Product C-More Ea9 Hmi Ea9-T10cl Default
unaffected
Affected
- ≥ 0, ≤ 6.77
Vendor AutomationDirect Product C-More Ea9 Hmi Ea9-T10wcl Default
unaffected
Affected
- ≥ 0, ≤ 6.77
Vendor AutomationDirect Product C-More Ea9 Hmi Ea9-T12cl Default
unaffected
Affected
- ≥ 0, ≤ 6.77
Vendor AutomationDirect Product C-More Ea9 Hmi Ea9-T15cl Default
unaffected
Affected
- ≥ 0, ≤ 6.77
Vendor AutomationDirect Product C-More Ea9 Hmi Ea9-T15cl-R Default
unaffected
Affected
- ≥ 0, ≤ 6.77
Vendor AutomationDirect Product C-More Ea9 Hmi Ea9-T6cl Default
unaffected
Affected
- ≥ 0, ≤ 6.77
Vendor AutomationDirect Product C-More Ea9 Hmi Ea9-T7cl Default
unaffected
Affected
- ≥ 0, ≤ 6.77
Vendor AutomationDirect Product C-More Ea9 Hmi Ea9-T8cl Default
unaffected
Affected
- ≥ 0, ≤ 6.77

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
AutomationDirect	C-More Ea9 Hmi Ea0-T7cl-R	unaffected	Affected ≥ 0, ≤ 6.77
AutomationDirect	C-More Ea9 Hmi Ea9-Pgmsw	unaffected	Affected ≥ 0, ≤ 6.77
AutomationDirect	C-More Ea9 Hmi Ea9-Rhmi	unaffected	Affected ≥ 0, ≤ 6.77
AutomationDirect	C-More Ea9 Hmi Ea9-T10cl	unaffected	Affected ≥ 0, ≤ 6.77
AutomationDirect	C-More Ea9 Hmi Ea9-T10wcl	unaffected	Affected ≥ 0, ≤ 6.77
AutomationDirect	C-More Ea9 Hmi Ea9-T12cl	unaffected	Affected ≥ 0, ≤ 6.77
AutomationDirect	C-More Ea9 Hmi Ea9-T15cl	unaffected	Affected ≥ 0, ≤ 6.77
AutomationDirect	C-More Ea9 Hmi Ea9-T15cl-R	unaffected	Affected ≥ 0, ≤ 6.77
AutomationDirect	C-More Ea9 Hmi Ea9-T6cl	unaffected	Affected ≥ 0, ≤ 6.77
AutomationDirect	C-More Ea9 Hmi Ea9-T7cl	unaffected	Affected ≥ 0, ≤ 6.77
AutomationDirect	C-More Ea9 Hmi Ea9-T8cl	unaffected	Affected ≥ 0, ≤ 6.77

Vendor Automationdirect Product C-More Ea9-Pgmsw Firmware Default
unknown
Affected
- ≥ 0, ≤ 6.77
Vendor Automationdirect Product C-More Ea9-Rhmi Firmware Default
unknown
Affected
- ≥ 0, ≤ 6.77
Vendor Automationdirect Product C-More Ea9-T10cl Firmware Default
unknown
Affected
- ≥ 0, ≤ 6.77
Vendor Automationdirect Product C-More Ea9-T10wcl Firmware Default
unknown
Affected
- ≥ 0, ≤ 6.77
Vendor Automationdirect Product C-More Ea9-T12cl Firmware Default
unknown
Affected
- ≥ 0, ≤ 6.77
Vendor Automationdirect Product C-More Ea9-T15cl-R Firmware Default
unknown
Affected
- ≥ 0, ≤ 6.77
Vendor Automationdirect Product C-More Ea9-T15cl Firmware Default
unknown
Affected
- ≥ 0, ≤ 6.77
Vendor Automationdirect Product C-More Ea9-T6cl Firmware Default
unknown
Affected
- ≥ 0, ≤ 6.77
Vendor Automationdirect Product C-More Ea9-T7cl-R Firmware Default
unknown
Affected
- ≥ 0, ≤ 6.77
Vendor Automationdirect Product C-More Ea9-T7cl Firmware Default
unknown
Affected
- ≥ 0, ≤ 6.77
Vendor Automationdirect Product C-More Ea9-T8cl Firmware Default
unknown
Affected
- ≥ 0, ≤ 6.77

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Automationdirect	C-More Ea9-Pgmsw Firmware	unknown	Affected ≥ 0, ≤ 6.77
Automationdirect	C-More Ea9-Rhmi Firmware	unknown	Affected ≥ 0, ≤ 6.77
Automationdirect	C-More Ea9-T10cl Firmware	unknown	Affected ≥ 0, ≤ 6.77
Automationdirect	C-More Ea9-T10wcl Firmware	unknown	Affected ≥ 0, ≤ 6.77
Automationdirect	C-More Ea9-T12cl Firmware	unknown	Affected ≥ 0, ≤ 6.77
Automationdirect	C-More Ea9-T15cl-R Firmware	unknown	Affected ≥ 0, ≤ 6.77
Automationdirect	C-More Ea9-T15cl Firmware	unknown	Affected ≥ 0, ≤ 6.77
Automationdirect	C-More Ea9-T6cl Firmware	unknown	Affected ≥ 0, ≤ 6.77
Automationdirect	C-More Ea9-T7cl-R Firmware	unknown	Affected ≥ 0, ≤ 6.77
Automationdirect	C-More Ea9-T7cl Firmware	unknown	Affected ≥ 0, ≤ 6.77
Automationdirect	C-More Ea9-T8cl Firmware	unknown	Affected ≥ 0, ≤ 6.77

Remediation

Vendor solution

AutomationDirect recommends that users update C-MORE EA9 HMI to V6.78 https://www.automationdirect.com/support/software-downloads .

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-22484
Advisory
https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01
government-resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-22484		Advisory
https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01		government-resource

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner icscert

Published Mar 26, 2024

Updated Aug 8, 2024

Reserved Feb 5, 2024

Link CVE-2024-25136

CISA Vulnrichment

Updated Aug 8, 2024

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2024-25136

Red Hat

No data

ENISA EUVD

Assigner icscert

Published Mar 26, 2024

Updated Aug 8, 2024

Link EUVD-2024-22484

GitHub

No data