www.cisa.gov
Open in
urlscan Pro
2a02:26f0:3100:389::447a
Public Scan
URL:
https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01
Submission: On March 27 via api from TR — Scanned from DE
Submission: On March 27 via api from TR — Scanned from DE
Form analysis 2 forms found in the DOM
<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
<table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<div class="gsc-input-box" id="gsc-iw-id1">
<table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
<tbody>
<tr>
<td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
<td class="gsib_b">
<div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
<td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
<title>search</title>
<path
d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
</path>
</svg></button></td>
<td class="gsc-clear-button">
<div class="gsc-clear-button" title="clear results"> </div>
</td>
</tr>
</tbody>
</table>
</form><form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
<table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<div class="gsc-input-box" id="gsc-iw-id2">
<table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
<tbody>
<tr>
<td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
<td class="gsib_b">
<div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
<td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
<title>search</title>
<path
d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
</path>
</svg></button></td>
<td class="gsc-clear-button">
<div class="gsc-clear-button" title="clear results"> </div>
</td>
</tr>
</tbody>
</table>
</form>Text Content
Skip to main content
An official website of the United States government
Here’s how you know
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United
States.
Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the
.gov website. Share sensitive information only on official, secure websites.
#protect2024Secure Our WorldShields UpReport A Cyber Issue
Cybersecurity & Infrastructure Security Agency
America's Cyber Defense Agency
Search
×
search
Menu
Close
×
search
* Topics
Topics
Cybersecurity Best Practices
Cyber Threats and Advisories
Critical Infrastructure Security and Resilience
Election Security
Emergency Communications
Industrial Control Systems
Information and Communications Technology Supply Chain Security
Partnerships and Collaboration
Physical Security
Risk Management
How can we help?
GovernmentEducational InstitutionsIndustryState, Local, Tribal, and
TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help
LocallyFaith-Based CommunityExecutives
* Spotlight
* Resources & Tools
Resources & Tools
All Resources & Tools
Services
Programs
Resources
Training
Groups
* News & Events
News & Events
News
Events
Cybersecurity Alerts & Advisories
Directives
Request a CISA Speaker
Congressional Testimony
CISA Conferences
CISA Live!
* Careers
Careers
Benefits & Perks
HireVue Applicant Reasonable Accommodations Process
Hiring
Resume & Application Tips
Students & Recent Graduates
Veteran and Military Spouses
Work @ CISA
* About
About
Culture
Divisions & Offices
Regions
Leadership
Doing Business with CISA
Site Links
Reporting Employee and Contractor Misconduct
CISA GitHub
2022 Year In Review
2023 Year In Review
Contact Us
#protect2024Secure Our WorldShields UpReport A Cyber Issue
America's Cyber Defense Agency
Breadcrumb
1. Home
2. News & Events
3. Cybersecurity Advisories
4. ICS Advisory
Share:
ICS Advisory
AUTOMATION-DIRECT C-MORE EA9 HMI
Release Date
March 26, 2024
Alert Code
ICSA-24-086-01
View CSAF(link is external)
1. EXECUTIVE SUMMARY
* CVSS v3 7.5
* ATTENTION: Exploitable remotely/low attack complexity
* Vendor: AutomationDirect
* Equipment: C-MORE EA9 HMI
* Vulnerabilities: Path Traversal, Stack-Based Buffer Overflow, Plaintext
Storage of a Password
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to
exploit a remote device and inject malicious code on the panel.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of C-MORE EA9 HMI, a display system used for interfacing
with controllers, are affected:
* C-MORE EA9 HMI EA9-T6CL: Version 6.77 and prior
* C-MORE EA9 HMI EA9-T7CL: Version 6.77 and prior
* C-MORE EA9 HMI EA0-T7CL-R: Version 6.77 and prior
* C-MORE EA9 HMI EA9-T8CL: Version 6.77 and prior
* C-MORE EA9 HMI EA9-T10CL: Version 6.77 and prior
* C-MORE EA9 HMI EA9-T10WCL: Version 6.77 and prior
* C-MORE EA9 HMI EA9-T12CL: Version 6.77 and prior
* C-MORE EA9 HMI EA9-T15CL: Version 6.77 and prior
* C-MORE EA9 HMI EA9-T15CL-R: Version 6.77 and prior
* C-MORE EA9 HMI EA9-RHMI: Version 6.77 and prior
* C-MORE EA9 HMI EA9-PGMSW: Version 6.77 and prior
3.2 VULNERABILITY OVERVIEW
3.2.1 Improper Limitation of a Pathname to a Restricted Directory ('Path
Traversal') CWE-22(link is external)
There is a function in Automation-Direct C-MORE EA9 HMI that allows an attacker
to send a relative path in the URL without proper sanitizing of the content.
CVE-2024-25136 has been assigned to this vulnerability. A CVSS v3.1 base score
of 7.5 has been calculated; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H(link is external))
CVE-2024-25136 has been assigned to this vulnerability. A CVSS v4 base score of
8.7 has been calculated; the CVSS vector string is
(AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N(link is external)).
3.2.2 Stack-based Buffer Overflow CWE-121(link is external)
In Automation-Direct C-MORE EA9 HMI there is a program that copies a buffer of a
size controlled by the user into a limited sized buffer on the stack which leads
to a stack overflow. The result of this stack-based buffer overflow will lead to
a denial-of-service conditions.
CVE-2024-25137 has been assigned to this vulnerability. A CVSS v3.1 base score
of 4.3 has been calculated; the CVSS vector string is
(AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L(link is external))
CVE-2024-25137 has been assigned to this vulnerability. A CVSS v4 base score of
5.3 has been calculated; the CVSS vector string is
(AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N(link is external)).
3.2.3 Plaintext Storage of a Password CWE-256(link is external)
In Automation-Direct C-MORE EA9 HMI credentials used by the platform are stored
as plain text on the device.
CVE-2024-25138 has been assigned to this vulnerability. A CVSS v3.1 base score
of 6.5 has been calculated; the CVSS vector string is
(AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N(link is external))
CVE-2024-25138 has been assigned to this vulnerability. A CVSS v4 base score of
7.1 has been calculated; the CVSS vector string is
(AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N(link is external)).
3.3 BACKGROUND
* CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical
Manufacturing, Energy, Water and Wastewater
* COUNTRIES/AREAS DEPLOYED: Worldwide
* COMPANY HEADQUARTERS LOCATION: United States
3.4 RESEARCHER
Tomer Goldschmidt of Claroty Research - Team82 reported these vulnerabilities to
CISA.
4. MITIGATIONS
AutomationDirect recommends that users update C-MORE EA9 HMI to V6.78(link is
external).
CISA recommends users take defensive measures to minimize the risk of
exploitation of these vulnerabilities, such as:
* Minimize network exposure for all control system devices and/or systems,
ensuring they are not accessible from the internet.
* Locate control system networks and remote devices behind firewalls and
isolating them from business networks.
* When remote access is required, use more secure methods, such as Virtual
Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should
be updated to the most current version available. Also recognize VPN is only
as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment
prior to deploying defensive measures.
CISA also provides a section for control systems security recommended
practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing
cyber defense best practices are available for reading and download,
including Improving Industrial Control Systems Cybersecurity with
Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies
for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage at cisa.gov/ics in the technical information
paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies.
Organizations observing suspected malicious activity should follow established
internal procedures and report findings to CISA for tracking and correlation
against other incidents.
No known public exploitation specifically targeting these vulnerabilities has
been reported to CISA at this time.
5. UPDATE HISTORY
* March 26, 2024: Initial Publication
This product is provided subject to this Notification and this Privacy &
Use policy.
VENDOR
AutomationDirect
PLEASE SHARE YOUR THOUGHTS
We recently updated our anonymous product survey; we’d welcome your feedback.
RELATED ADVISORIES
Mar 26, 2024
ICS Advisory | ICSA-24-086-04
ROCKWELL AUTOMATION FACTORYTALK VIEW ME
Mar 26, 2024
ICS Advisory | ICSA-24-086-02
ROCKWELL AUTOMATION POWERFLEX 527
Mar 26, 2024
ICS Advisory | ICSA-24-086-03
ROCKWELL AUTOMATION ARENA SIMULATION
Mar 21, 2024
ICS Advisory | ICSA-24-081-01
ADVANTECH WEBACCESS/SCADA
Return to top
* Topics
* Spotlight
* Resources & Tools
* News & Events
* Careers
* About
Cybersecurity & Infrastructure Security Agency
* Facebook
* Twitter
* LinkedIn
* YouTube
* Instagram
CISA Central 888-282-0870 central@cisa.dhs.gov(link sends email)
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
* About CISA
* Accessibility
* Budget and Performance
* DHS.gov
* FOIA Requests
* No FEAR Act
* Office of Inspector General
* Privacy Policy
* Subscribe
* The White House
* USA.gov
* Website Feedback