AutomationDirect C-more EA9 HMI Cleartext Transmission
CVE-2022-2005

7.5HIGH

Key Information:

Vendor

Automationdirect

Status
C-more Ea9
Vendor
CVE Published:
31 August 2022

What is CVE-2022-2005?

AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;

Affected Version(s)

C-more EA9 EA9-T6CL < 6.73

C-more EA9 EA9-T6CL-R < 6.73

C-more EA9 EA9-T7CL < 6.73

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sam Hanson of Dragos reported this vulnerability to CISA.
.