Automationdirect C-More EA9-Pgmsw Firmware vulnerabilities

3 CVEs affecting Automationdirect C-More EA9-Pgmsw Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-25136, published 2024-03-26.

More from Automationdirect.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-25136, published 2024-03-26. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content.
• CVE-2022-2005, published 2022-08-31. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a…
• CVE-2022-2006, published 2022-08-31. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more…