CVE-2022-2005 AutomationDirect C-more EA9 HMI Cleartext Transmission
An attacker can intercept cleartext credentials transmitted by the HMI web server to gain unauthorized access to the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-2005?
CVE-2022-2005 is a high-severity vulnerability in AutomationDirect C-more EA9, published on 31 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;
Weakness: CWE-319
Which versions are affected by CVE-2022-2005?
It affects 12 products.
Products include Automationdirect C-More Ea9-Pgmsw Firmware, Automationdirect C-More Ea9-Rhmi Firmware, Automationdirect C-More Ea9-T10cl Firmware, Automationdirect C-More Ea9-T10wcl Firmware, Automationdirect C-More Ea9-T12cl Firmware, Automationdirect C-More Ea9-T15cl-R Firmware and 6 more.
How do I fix CVE-2022-2005?
No fix has been published for CVE-2022-2005 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-2005 being exploited?
There is no known exploitation of CVE-2022-2005 in the wild and no public exploit code.
Other vulnerabilities in AutomationDirect C-more EA9
Sources
Also known as GHSA-g8fh-5c5f-8vq4.