CVE-2020-10918 Auth bypass in HMI EA9
Remote attackers can bypass authentication on C-MORE HMI panels to access protected resources and escalate privileges without credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10918?
CVE-2020-10918 is a high-severity authentication bypass vulnerability in C-MORE HMI EA9, published on 23 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue is due to insufficient authentication on post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from unauthenticated users. Was ZDI-CAN-10182.
Weakness: CWE-287
Which versions are affected by CVE-2020-10918?
It affects 1 product.
Products include Automationdirect C-More Hmi Ea9 Firmware.
How do I fix CVE-2020-10918?
No fix has been published for CVE-2020-10918 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-10918 being exploited?
There is no known exploitation of CVE-2020-10918 in the wild and no public exploit code.
Other vulnerabilities in C-MORE HMI EA9
Sources
Also known as GHSA-rc5j-fh2q-crhv.