« Volver al listado

CVE-2020-10919

Estado: ModificadaMedia (5.9)—

This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-10185.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Automationdirect — C-more HMI EA9 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-10919",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "zdi-disclosures@trendmicro.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "affectedData": [
        {
          "vendor": "C-MORE",
          "product": "HMI EA9",
          "versions": [
            {
              "status": "affected",
              "version": "Firmware version 6.52"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-07-23T16:15:12.193",
  "references": [
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-806/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-806/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "zdi-disclosures@trendmicro.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-261"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-326"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-10185."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad permite a los atacantes remotos revelar información sensible en las instalaciones afectadas de los paneles de pantalla táctil C-MORE HMI EA9 Firmware versión 6.52. La autenticación no es necesaria para explotar esta vulnerabilidad. El fallo específico existe en el manejo de las contraseñas. Al transmitir las contraseñas, el proceso las encripta en un formato recuperable. Un atacante puede aprovechar esta vulnerabilidad para revelar las credenciales, lo que llevaría a un mayor compromiso. Era ZDI-CAN-10185"
    }
  ],
  "lastModified": "2026-06-17T02:48:40.810",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:automationdirect:c-more_hmi_ea9_firmware:6.52:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1C98599-C96A-4EEE-BC82-A6F01398E077"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-pgmsw:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "656B3283-FA47-4CCF-A124-FBAEC86BB7A7"
            },
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-rhmi:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DD7D15B5-FC1D-4B0E-85CC-CEF3A68C2BA4"
            },
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-t10cl:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "584FBF19-4AFB-425F-9A78-A450C8EF4D74"
            },
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-t10wcl:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F79F5A11-21E8-4126-8333-1DEAFD91100E"
            },
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-t12cl:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8F3BC5B7-55B3-41FC-959F-745171FD6AB8"
            },
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-t15cl:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "63E6454D-E722-45DA-8AD7-4469DA515B62"
            },
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-t15cl-r:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8B271A9F-5E71-4C03-8A78-84398183903C"
            },
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-t6cl:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "43E2E05B-41C9-4BE6-9344-2A78C3CE0B11"
            },
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-t6cl-r:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "EF5C6D94-BFA6-48FF-9776-FA7C91ABE1CD"
            },
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-t7cl:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "ABC8D7A3-A3CD-4C6F-8256-FD91927C1CE4"
            },
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-t7cl-r:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1BE509D4-C93C-4A7F-B5C9-892073640916"
            },
            {
              "criteria": "cpe:2.3:h:automationdirect:ea9-t8cl:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "66885733-FD7F-4BAB-9F41-1823372FBA6D"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com"
}