No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Tomer Goldschmidt (Claroty Research - Team82)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-25136 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 7.5 High |
There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without properly sanitizing the content. Mitigation: AutomationDirect recommends that users update C-MORE EA9 HMI to V6.78 or later. ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-25138 | CWE-256 Plaintext Storage of a Password | 6.5 Medium |
In AutomationDirect C-MORE EA9 HMI credentials used by the platform are stored as plain text on the device. Mitigation: AutomationDirect recommends that users update C-MORE EA9 HMI to V6.78 or later. ↗ Affected, fixed & timelineAffected:
|
| CVE-2024-25137 | CWE-121 Stack-based Buffer Overflow | 4.3 Medium |
In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which leads to a stack overflow. The result of this stack-based buffer overflow will lead to a denial-of-service condition. Mitigation: AutomationDirect recommends that users update C-MORE EA9 HMI to V6.78 or later. ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-25136 | 7.5 High | AutomationDirect C-MORE EA9 HMI EA9-T6CL There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the c… |
| CVE-2024-25138 | 6.5 Medium | AutomationDirect C-MORE EA9 HMI EA9-T6CL In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device. |
| CVE-2024-25137 | 4.3 Medium | AutomationDirect C-MORE EA9 HMI EA9-T6CL In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.