Automationdirect C-More EA9-t7cl-R Firmware vulnerabilities

4 CVEs affecting Automationdirect C-More EA9-t7cl-R Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-25136, published 2024-03-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-6969, published 2020-02-05. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More Touch Panels EA9 series: firmware…
CVE-2024-25136, published 2024-03-26. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content.
CVE-2022-2005, published 2022-08-31. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a…
CVE-2022-2006, published 2022-08-31. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more…