www.cisa.gov Open in urlscan Pro
2600:1408:c400:984::447a  Public Scan

Form analysis
2 forms found in the DOM

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id1">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id2">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

Text Content

Skip to main content

An official website of the United States government

Here’s how you know

Here’s how you know

Official websites use .gov
A .gov website belongs to an official government organization in the United
States.

Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the
.gov website. Share sensitive information only on official, secure websites.

Free Cyber ServicesElection Threat Updates#protect2024Secure Our WorldShields
UpReport A Cyber Issue



Search

×

search
 

Menu



Close
×

search
 

 * Topics
   Topics
   Cybersecurity Best Practices
   Cyber Threats and Advisories
   Critical Infrastructure Security and Resilience
   Election Security
   Emergency Communications
   Industrial Control Systems
   Information and Communications Technology Supply Chain Security
   Partnerships and Collaboration
   Physical Security
   Risk Management
   How can we help?
   GovernmentEducational InstitutionsIndustryState, Local, Tribal, and
   TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help
   LocallyFaith-Based CommunityExecutivesHigh-Risk Communities
 * Spotlight
 * Resources & Tools
   Resources & Tools
   All Resources & Tools
   Services
   Programs
   Resources
   Training
   Groups
 * News & Events
   News & Events
   News
   Events
   Cybersecurity Alerts & Advisories
   Directives
   Request a CISA Speaker
   Congressional Testimony
   CISA Conferences
   CISA Live!
 * Careers
   Careers
   Benefits & Perks
   HireVue Applicant Reasonable Accommodations Process
   Hiring
   Resume & Application Tips
   Students & Recent Graduates
   Veteran and Military Spouses
   Work @ CISA
 * About
   About
   Culture
   Divisions & Offices
   Regions
   Leadership
   Doing Business with CISA
   Site Links
   Reporting Employee and Contractor Misconduct
   CISA GitHub
   CISA Central
   2023 Year In Review
   Contact Us
   Subscribe

Free Cyber ServicesElection Threat Updates#protect2024Secure Our WorldShields
UpReport A Cyber Issue

Breadcrumb
 1. Home
 2. News & Events
 3. Cybersecurity Advisories
 4. ICS Advisory

Share:


ICS Advisory


AUTOMATIONDIRECT C-MORE EA9 PROGRAMMING SOFTWARE

Release Date
December 05, 2024
Alert Code
ICSA-24-340-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems


View CSAF(link is external)


1. EXECUTIVE SUMMARY

 * CVSS v4 8.4
 * ATTENTION: Low attack complexity
 * Vendor: AutomationDirect
 * Equipment: C-More EA9 Programming Software
 * Vulnerabilities: Stack-based Buffer Overflow


2. RISK EVALUATION

Successful exploitation of these vulnerabilities could result in memory
corruption; a buffer overflow condition may allow remote code execution.


3. TECHNICAL DETAILS


3.1 AFFECTED PRODUCTS

AutomationDirect reports that the following versions of C-more EA9 series
programming software are affected:

 * C-More EA9 Programming Software: version 6.78 and prior


3.2 VULNERABILITY OVERVIEW

3.2.1 STACK-BASED BUFFER OVERFLOW CWE-121(LINK IS EXTERNAL)

A file parsing stack-based buffer overflow remote code execution vulnerability
is a serious software flaw that arises when an application or system improperly
handles input files, leading to a stack-based buffer overflow. If exploited,
this vulnerability allows attackers to execute arbitrary code remotely, often
resulting in system compromise or unauthorized control.

CVE-2024-11609(link is external) has been assigned to this vulnerability. A CVSS
v3.1 base score of 7.8 has been calculated; the CVSS vector string is
(CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H(link is external)).

A CVSS v4 score has also been calculated for CVE-2024-11609(link is external). A
base score of 8.4 has been calculated; the CVSS vector string is
(CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N(link is
external)).

3.2.2 STACK-BASED BUFFER OVERFLOW CWE-121(LINK IS EXTERNAL)

A file parsing memory corruption remote code execution vulnerability occurs when
an application fails to safely handle data during the parsing of files,
resulting in memory corruption. If exploited, this vulnerability can allow an
attacker to execute arbitrary code remotely, potentially compromising the target
system.

CVE-2024-11610(link is external) has been assigned to this vulnerability. A CVSS
v3.1 base score of 7.8 has been calculated; the CVSS vector string is
(CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H(link is external)).

A CVSS v4 score has also been calculated for CVE-2024-11610(link is external). A
base score of 8.4 has been calculated; the CVSS vector string is
(CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N(link is
external)).

3.2.3 STACK-BASED BUFFER OVERFLOW CWE-121(LINK IS EXTERNAL)

A file parsing memory corruption remote code execution vulnerability occurs when
an application fails to safely handle data during the parsing of files,
resulting in memory corruption. If exploited, this vulnerability can allow an
attacker to execute arbitrary code remotely, potentially compromising the
targeted system.

CVE-2024-11611(link is external) has been assigned to this vulnerability. A CVSS
v3.1 base score of 7.8 has been calculated; the CVSS vector string is
(CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H(link is external)).

A CVSS v4 score has also been calculated for CVE-2024-11611(link is external). A
base score of 8.4 has been calculated; the CVSS vector string is
(CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N(link is
external)).


3.3 BACKGROUND

 * CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical
   Manufacturing, Energy, Water and Wastewater
 * COUNTRIES/AREAS DEPLOYED: Worldwide
 * COMPANY HEADQUARTERS LOCATION: United States


3.4 RESEARCHER

Andrea Micalizzi aka rgod (@rgod777) working with Trend Micro Zero Day
Initiative reported these vulnerabilities to AutomationDirect.


4. MITIGATIONS

To resolve these vulnerabilities AutomationDirect recommends that users update
C-MORE EA9 HMI to V6.79.(link is external)

If an immediate update is not feasible, AutomationDirect recommends considering
the following interim steps until the programming software can be updated:

 1. Isolate the Engineering Workstation:

 * Disconnect the workstation from external networks (e.g., internet or
   corporate LAN) to limit exposure to external threats.
 * Use dedicated, secure internal networks or air-gapped systems for
   communication with programmable devices.

 2. Control Access:

 * Restrict physical and logical access to the workstation to authorized
   personnel only.
 * Implement multi-factor authentication (MFA) and robust password policies for
   user accounts.

 3. Implement Whitelisting:

 * Use application whitelisting to allow only pre-approved and trusted software
   to execute on the workstation.
 * Block untrusted or unauthorized applications.

 4. Apply Endpoint Security Measures:

 * Use antivirus or endpoint detection and response (EDR) tools to monitor for
   and mitigate threats.
 * Ensure that host-based firewalls are properly configured to block
   unauthorized access.

 5. Monitor and Log Activity:

 * Enable logging and monitoring of system activities to detect potential
   anomalies or unauthorized actions.
 * Regularly review logs for suspicious activity.

 6. Harden the Workstation:

 * Remove or disable unnecessary services and software to reduce the attack
   surface.
 * Implement security configurations, such as disabling autorun for USB drives
   or restricting administrative privileges.

 7. Use Secure Backup and Recovery:

 * Regularly back up the workstation and its configurations to a secure
   location.
 * Test recovery procedures to ensure minimal downtime in the event of an
   incident.

 8. Conduct Regular Risk Assessments:

 * Continuously assess the risks posed by the outdated software and adjust
   mitigation measures as necessary.

For more information, see the AutomationDirect security advisory.(link is
external)

CISA recommends users take the following measures to protect themselves from
social engineering attacks:

 * Do not click web links or open attachments in unsolicited email messages.
 * Refer to Recognizing and Avoiding Email Scams for more information on
   avoiding email scams.
 * Refer to Avoiding Social Engineering and Phishing Attacks for more
   information on social engineering attacks.

CISA reminds organizations to perform proper impact analysis and risk assessment
prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices
on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber
defense best practices are available for reading and download, including
Improving Industrial Control Systems Cybersecurity with Defense-in-Depth
Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies
for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage at cisa.gov/ics in the technical information paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies.

Organizations observing suspected malicious activity should follow established
internal procedures and report findings to CISA for tracking and correlation
against other incidents.

No known public exploitation specifically targeting these vulnerabilities has
been reported to CISA at this time. These vulnerabilities are not exploitable
remotely.


5. UPDATE HISTORY

 * December 5, 2024: Initial Publication

This product is provided subject to this Notification and this Privacy &
Use policy.


VENDOR

 * AutomationDirect


TAGS

Sector: Commercial Facilities Sector, Critical Manufacturing Sector, Energy
Sector, Water and Wastewater Systems
Topics: Industrial Control System Vulnerabilities, Industrial Control Systems


PLEASE SHARE YOUR THOUGHTS

We recently updated our anonymous product survey; we’d welcome your feedback.


RELATED ADVISORIES

Dec 05, 2024
ICS Advisory | ICSA-24-340-02


PLANET TECHNOLOGY PLANET WGS-804HPT

Dec 03, 2024
ICS Advisory | ICSA-24-338-03


OPEN AUTOMATION SOFTWARE

Dec 03, 2024
ICS Advisory | ICSA-24-338-02


SIEMENS RUGGEDCOM APE1808

Dec 03, 2024
ICS Advisory | ICSA-24-338-04


ICONICS AND MITSUBISHI ELECTRIC PRODUCTS

Return to top
 * Topics
 * Spotlight
 * Resources & Tools
 * News & Events
 * Careers
 * About

Cybersecurity & Infrastructure Security Agency
 * Facebook
 * Twitter
 * LinkedIn
 * YouTube
 * Instagram
 * RSS

CISA Central 1-844-Say-CISA SayCISA@cisa.dhs.gov
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
 * About CISA
 * Budget and Performance
 * DHS.gov
 * Equal Opportunity & Accessibility
 * FOIA Requests
 * No FEAR Act
 * Office of Inspector General
 * Privacy Policy
 * Subscribe
 * The White House
 * USA.gov
 * Website Feedback