Lucene search

ZdiCVELIST:CVE-2020-10921

HistoryJul 23, 2020 - 3:35 p.m.

CVE-2020-10921

2020-07-2315:35:19

CWE-306

zdi

www.cve.org

vulnerability

remote attackers

c-more hmi

ea9 firmware

command execution

authentication

ea-http.exe

system configuration

physical equipment

zdi-can-10482

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.022

Percentile

89.6%

JSON

This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. Was ZDI-CAN-10482.

CNA Affected

[
  {
    "product": "HMI EA9",
    "vendor": "C-MORE",
    "versions": [
      {
        "status": "affected",
        "version": "Firmware version 6.52"
      }
    ]
  }
]

References

www.zerodayinitiative.com/advisories/ZDI-20-807/

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.022

Percentile

89.6%

JSON

Related for CVELIST:CVE-2020-10921