VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2025/0xxx/CVE-2025-0960.json
T

320 lines
16 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"cveId": "CVE-2025-0960",
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"state": "PUBLISHED",
"assignerShortName": "icscert",
"dateReserved": "2025-01-31T22:04:58.932Z",
"datePublished": "2025-02-04T19:34:25.961Z",
"dateUpdated": "2025-02-04T19:50:52.268Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "C-more EA9 HMI EA9-T6CL",
"vendor": "AutomationDirect",
"versions": [
{
"lessThanOrEqual": "v6.79",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "C-more EA9 HMI EA9-T7CL-R",
"vendor": "AutomationDirect",
"versions": [
{
"lessThanOrEqual": "v6.79",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "C-more EA9 HMI EA9-T7CL",
"vendor": "AutomationDirect",
"versions": [
{
"lessThanOrEqual": "v6.79",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "C-more EA9 HMI EA9-T8CL",
"vendor": "AutomationDirect",
"versions": [
{
"lessThanOrEqual": "v6.79",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "C-more EA9 HMI EA9-T10CL",
"vendor": "AutomationDirect",
"versions": [
{
"lessThanOrEqual": "v6.79",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "C-more EA9 HMI EA9-T10WCL",
"vendor": "AutomationDirect",
"versions": [
{
"lessThanOrEqual": "v6.79",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "C-more EA9 HMI EA9-T12CL",
"vendor": "AutomationDirect",
"versions": [
{
"lessThanOrEqual": "v6.79",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "C-more EA9 HMI EA9-T15CL-R",
"vendor": "AutomationDirect",
"versions": [
{
"lessThanOrEqual": "v6.79",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "C-more EA9 HMI EA9-T15CL",
"vendor": "AutomationDirect",
"versions": [
{
"lessThanOrEqual": "v6.79",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "C-more EA9 HMI EA9-RHMI",
"vendor": "AutomationDirect",
"versions": [
{
"lessThanOrEqual": "v6.79",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sharon Brizinov of Claroty Team82 reported this vulnerability to CISA."
}
],
"datePublic": "2025-02-04T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an attacker abusing the function to cause a denial-of-service condition or achieving remote code execution on the affected device.</span>"
}
],
"value": "AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an attacker abusing the function to cause a denial-of-service condition or achieving remote code execution on the affected device."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert",
"dateUpdated": "2025-02-04T19:34:25.961Z"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-08"
},
{
"url": "https://community.automationdirect.com/s/cybersecurity/security-advisories"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>AutomationDirect recommends that users update C-MORE EA9 HMI software and firmware to <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.automationdirect.com/firmware/historydetail.php?pid=62\">V6.80</a>.</p><br>"
}
],
"value": "AutomationDirect recommends that users update C-MORE EA9 HMI software and firmware to V6.80 https://support.automationdirect.com/firmware/historydetail.php ."
}
],
"source": {
"advisory": "ICSA-25-035-08",
"discovery": "EXTERNAL"
},
"title": "AutomationDirect C-more EA9 HMI Classic Buffer Overflow",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>If an immediate update is not feasible, AutomationDirect recommends \nconsidering the following interim steps until the programming software \ncan be updated:</p><ul><li>Isolate the HMI Workstation: Disconnect the \nHMI from external networks (e.g., internet or corporate LAN) to limit \nexposure to external threats.</li><li>Use dedicated, secure internal networks or air-gapped systems for communication with programmable devices.</li><li>Control Access: Restrict physical and logical access to the HMI to authorized personnel only.</li><li>Implement\n Whitelisting: Use application whitelisting to allow only pre-approved \nand trusted software to execute on the HMI. Block untrusted or \nunauthorized applications.</li><li>Apply Endpoint Security Measures: Use\n antivirus or endpoint detection and response (EDR) tools to monitor for\n and mitigate threats. Ensure that host-based firewalls are properly \nconfigured to block unauthorized access.</li><li>Monitor and Log \nActivity: Enable logging and monitoring of system activities to detect \npotential anomalies or unauthorized actions. Regularly review logs for \nsuspicious activity.</li><li>Use Secure Backup and Recovery: Regularly \nback up the workstation and its configurations to a secure location. \nTest recovery procedures to ensure minimal downtime in the event of an \nincident.</li><li>Conduct Regular Risk Assessments: Continuously assess \nthe risks posed by the outdated software and adjust mitigation measures \nas necessary.</li></ul>\n\n<br>"
}
],
"value": "If an immediate update is not feasible, AutomationDirect recommends \nconsidering the following interim steps until the programming software \ncan be updated:\n\n * Isolate the HMI Workstation: Disconnect the \nHMI from external networks (e.g., internet or corporate LAN) to limit \nexposure to external threats.\n * Use dedicated, secure internal networks or air-gapped systems for communication with programmable devices.\n * Control Access: Restrict physical and logical access to the HMI to authorized personnel only.\n * Implement\n Whitelisting: Use application whitelisting to allow only pre-approved \nand trusted software to execute on the HMI. Block untrusted or \nunauthorized applications.\n * Apply Endpoint Security Measures: Use\n antivirus or endpoint detection and response (EDR) tools to monitor for\n and mitigate threats. Ensure that host-based firewalls are properly \nconfigured to block unauthorized access.\n * Monitor and Log \nActivity: Enable logging and monitoring of system activities to detect \npotential anomalies or unauthorized actions. Regularly review logs for \nsuspicious activity.\n * Use Secure Backup and Recovery: Regularly \nback up the workstation and its configurations to a secure location. \nTest recovery procedures to ensure minimal downtime in the event of an \nincident.\n * Conduct Regular Risk Assessments: Continuously assess \nthe risks posed by the outdated software and adjust mitigation measures \nas necessary."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2025-02-04T19:50:44.079280Z",
"id": "CVE-2025-0960",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2025-02-04T19:50:52.268Z"
}
}
]
}
}
View Git Blame Copy Permalink