CVE-2024-25138 - OpenCVE

In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2024-03-26T23:01:40.197Z

Updated: 2024-08-02T18:55:41.344Z

Reserved: 2024-02-05T21:38:12.857Z

Link: CVE-2024-25138

Vulnrichment

Updated: 2024-08-01T23:36:21.700Z

NVD

Status : Awaiting Analysis

Published: 2024-03-26T23:15:47.073

Modified: 2024-03-27T12:29:30.307

Link: CVE-2024-25138

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-25138", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-02-05T21:38:12.857Z", "datePublished": "2024-03-26T23:01:40.197Z", "dateUpdated": "2024-08-02T18:55:41.344Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T6CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T7CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA0-T7CL-R", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T8CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T10CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T10WCL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T12CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T15CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T15CL-R", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-RHMI", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "c"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-PGMSW", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Tomer Goldschmidt of Claroty Research - Team82 reported these vulnerabilities to CISA."}], "datePublic": "2024-03-26T19:18:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">In AutomationDirect C-MORE EA9 HMI, \n\n<span style=\"background-color: rgb(255, 255, 255);\">credentials used by the platform are stored as plain text on the device.</span>\n\n</span>\n\n</span>\n\n"}], "value": "\nIn AutomationDirect C-MORE EA9 HMI, \n\ncredentials used by the platform are stored as plain text on the device.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-256", "description": "CWE-256", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-03-26T23:15:37.216Z"}, "references": [{"tags": ["government-resource"], "url": "https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">AutomationDirect recommends that users update C-MORE EA9 HMI to </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.automationdirect.com/support/software-downloads\">V6.78</a><span style=\"background-color: rgb(255, 255, 255);\">.</span>\n\n<br>"}], "value": "\nAutomationDirect recommends that users update C-MORE EA9 HMI to V6.78 https://www.automationdirect.com/support/software-downloads .\n\n"}], "source": {"advisory": "ICSA-24-086-01", "discovery": "EXTERNAL"}, "title": "AutomationDirect C-MORE EA9 HMI Plaintext Storage of a Password", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.700Z"}, "title": "CVE Program Container", "references": [{"tags": ["government-resource", "x_transferred"], "url": "https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T18:42:16.488185Z", "id": "CVE-2024-25138", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T18:55:41.344Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-25138", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-02-05T21:38:12.857Z", "datePublished": "2024-03-26T23:01:40.197Z", "dateUpdated": "2024-08-02T18:55:41.344Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T6CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T7CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA0-T7CL-R", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T8CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T10CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T10WCL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T12CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T15CL", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-T15CL-R", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-RHMI", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "c"}]}, {"defaultStatus": "unaffected", "product": "C-MORE EA9 HMI EA9-PGMSW", "vendor": "AutomationDirect", "versions": [{"lessThanOrEqual": "6.77", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Tomer Goldschmidt of Claroty Research - Team82 reported these vulnerabilities to CISA."}], "datePublic": "2024-03-26T19:18:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">In AutomationDirect C-MORE EA9 HMI, \n\n<span style=\"background-color: rgb(255, 255, 255);\">credentials used by the platform are stored as plain text on the device.</span>\n\n</span>\n\n</span>\n\n"}], "value": "\nIn AutomationDirect C-MORE EA9 HMI, \n\ncredentials used by the platform are stored as plain text on the device.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-256", "description": "CWE-256", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-03-26T23:15:37.216Z"}, "references": [{"tags": ["government-resource"], "url": "https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">AutomationDirect recommends that users update C-MORE EA9 HMI to </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.automationdirect.com/support/software-downloads\">V6.78</a><span style=\"background-color: rgb(255, 255, 255);\">.</span>\n\n<br>"}], "value": "\nAutomationDirect recommends that users update C-MORE EA9 HMI to V6.78 https://www.automationdirect.com/support/software-downloads .\n\n"}], "source": {"advisory": "ICSA-24-086-01", "discovery": "EXTERNAL"}, "title": "AutomationDirect C-MORE EA9 HMI Plaintext Storage of a Password", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.700Z"}, "title": "CVE Program Container", "references": [{"tags": ["government-resource", "x_transferred"], "url": "https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01"}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-25138", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-02T18:42:16.488185Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T18:55:33.490Z"}}]}}