CVE-2024-25137 - OpenCVE

In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2024-03-26T22:58:44.753Z

Updated: 2024-08-01T23:36:21.635Z

Reserved: 2024-02-05T21:38:12.857Z

Link: CVE-2024-25137

Vulnrichment

Updated: 2024-08-01T23:36:21.635Z

NVD

Status : Awaiting Analysis

Published: 2024-03-26T23:15:46.873

Modified: 2024-03-27T12:29:30.307

Link: CVE-2024-25137

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-25137", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-02-05T21:38:12.857Z", "datePublished": "2024-03-26T22:58:44.753Z", "dateUpdated": "2024-08-01T23:36:21.635Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T6CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T7CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA0-T7CL-R", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T8CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T10CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T10WCL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T12CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T15CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T15CL-R", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-RHMI", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "c"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-PGMSW", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Tomer Goldschmidt of Claroty Research - Team82 reported these vulnerabilities to CISA."}], "datePublic": "2024-03-26T19:18:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions.</span>\n\n</span>\n\n"}], "value": "\nIn AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-03-26T23:16:14.278Z"}, "references": [{"tags": ["government-resource"], "url": "https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">AutomationDirect recommends that users update C-MORE EA9 HMI to </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.automationdirect.com/support/software-downloads\">V6.78</a><span style=\"background-color: rgb(255, 255, 255);\">.</span>\n\n<br>"}], "value": "\nAutomationDirect recommends that users update C-MORE EA9 HMI to V6.78 https://www.automationdirect.com/support/software-downloads .\n\n"}], "source": {"advisory": "ICSA-24-086-01", "discovery": "EXTERNAL"}, "title": "AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-25137", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-29T11:12:42.141439Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:34:59.391Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.635Z"}, "title": "CVE Program Container", "references": [{"tags": ["government-resource", "x_transferred"], "url": "https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01", "tags": ["government-resource", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.635Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-25137", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-29T11:12:42.141439Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-29T11:12:47.023Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow", "source": {"advisory": "ICSA-24-086-01", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Tomer Goldschmidt of Claroty Research - Team82 reported these vulnerabilities to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AutomationDirect", "product": "C-MORE EA9 HMI EA9-T6CL", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.77"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "C-MORE EA9 HMI EA9-T7CL", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.77"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "C-MORE EA9 HMI EA0-T7CL-R", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.77"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "C-MORE EA9 HMI EA9-T8CL", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.77"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "C-MORE EA9 HMI EA9-T10CL", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.77"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "C-MORE EA9 HMI EA9-T10WCL", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.77"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "C-MORE EA9 HMI EA9-T12CL", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.77"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "C-MORE EA9 HMI EA9-T15CL", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.77"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "C-MORE EA9 HMI EA9-T15CL-R", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.77"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "C-MORE EA9 HMI EA9-RHMI", "versions": [{"status": "affected", "version": "0", "versionType": "c", "lessThanOrEqual": "6.77"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "C-MORE EA9 HMI EA9-PGMSW", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.77"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nAutomationDirect recommends that users update C-MORE EA9 HMI to V6.78 https://www.automationdirect.com/support/software-downloads .\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">AutomationDirect recommends that users update C-MORE EA9 HMI to </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.automationdirect.com/support/software-downloads\">V6.78</a><span style=\"background-color: rgb(255, 255, 255);\">.</span>\n\n<br>", "base64": false}]}], "datePublic": "2024-03-26T19:18:00.000Z", "references": [{"url": "https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nIn AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions.</span>\n\n</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-03-26T23:16:14.278Z"}}}, "cveMetadata": {"cveId": "CVE-2024-25137", "state": "PUBLISHED", "dateUpdated": "2024-08-01T23:36:21.635Z", "dateReserved": "2024-02-05T21:38:12.857Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2024-03-26T22:58:44.753Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}