CVE-2020-6969 Information disclosure in C-More Touch Panels EA9 series
Attackers can unmask credentials in unprotected project files to remotely access and manipulate C-More Touch Panel configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6969?
CVE-2020-6969 is a critical vulnerability in C-More Touch Panels EA9 series, published on 5 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More Touch Panels EA9 series: firmware versions prior to 6.53 and manipulate system configurations.
Weakness: CWE-522
Which versions are affected by CVE-2020-6969?
It affects 11 products.
Products include Automationdirect C-More Ea9-Rhi Firmware, Automationdirect C-More Ea9-T10cl Firmware, Automationdirect C-More Ea9-T10wcl Firmware, Automationdirect C-More Ea9-T12cl Firmware, Automationdirect C-More Ea9-T15cl-R Firmware, Automationdirect C-More Ea9-T15cl Firmware and 5 more.
How do I fix CVE-2020-6969?
No fix has been published for CVE-2020-6969 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-6969 being exploited?
There is no known exploitation of CVE-2020-6969 in the wild and no public exploit code.
Sources
Also known as GHSA-vvr7-5892-5mm9.