CVE-2024-25137
Assigner: icscert
Published: 2024-03-26T22:58:44.753Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: C-MORE EA9 HMI EA9-T6CL
vendor: AutomationDirect
versions: lessThanOrEqual: 6.77
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: C-MORE EA9 HMI EA9-T7CL
vendor: AutomationDirect
versions: lessThanOrEqual: 6.77
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: C-MORE EA9 HMI EA0-T7CL-R
vendor: AutomationDirect
versions: lessThanOrEqual: 6.77
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: C-MORE EA9 HMI EA9-T8CL
vendor: AutomationDirect
versions: lessThanOrEqual: 6.77
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: C-MORE EA9 HMI EA9-T10CL
vendor: AutomationDirect
versions: lessThanOrEqual: 6.77
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: C-MORE EA9 HMI EA9-T10WCL
vendor: AutomationDirect
versions: lessThanOrEqual: 6.77
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: C-MORE EA9 HMI EA9-T12CL
vendor: AutomationDirect
versions: lessThanOrEqual: 6.77
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: C-MORE EA9 HMI EA9-T15CL
vendor: AutomationDirect
versions: lessThanOrEqual: 6.77
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: C-MORE EA9 HMI EA9-T15CL-R
vendor: AutomationDirect
versions: lessThanOrEqual: 6.77
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: C-MORE EA9 HMI EA9-RHMI
vendor: AutomationDirect
versions: lessThanOrEqual: 6.77
status: affected
version: 0
versionType: c
defaultStatus: unaffected
product: C-MORE EA9 HMI EA9-PGMSW
vendor: AutomationDirect
versions: lessThanOrEqual: 6.77
status: affected
version: 0
versionType: custom
credits: type: finder
value: Tomer Goldschmidt of Claroty Research - Team82 reported these vulnerabilities to CISA.
datePublic: 2024-03-26T19:18:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions.</span>

</span>


value: 
In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-121
description: CWE-121
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">AutomationDirect recommends that users update C-MORE EA9 HMI to </span><a target="_blank" rel="nofollow" href="https://www.automationdirect.com/support/software-downloads">V6.78</a><span style="background-color: rgb(255, 255, 255);">.</span>

<br>
value: 
AutomationDirect recommends that users update C-MORE EA9 HMI to  V6.78 https://www.automationdirect.com/support/software-downloads .


source: advisory: ICSA-24-086-01
discovery: EXTERNAL
title: AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow
x_generator: engine: Vulnogram 0.1.0-dev