CVSS 3.0
7.8 highCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2024-11611
High (7.8) in automationdirect. EPSS 0.3% chance of exploitation in the next 30 days.
AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AutomationDirect C-More EA9. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of EAP9 files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24774.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
- CWE
- CWE-119
- Published
- Modified
- Record from
- the NVD, synced
Affected
- automationdirect:c-more_ea9-rhmi_firmware
- automationdirect:c-more_ea9-t10cl_firmware
- automationdirect:c-more_ea9-t10wcl_firmware
- automationdirect:c-more_ea9-t12cl_firmware
- automationdirect:c-more_ea9-t15cl-r_firmware
- automationdirect:c-more_ea9-t15cl_firmware
- automationdirect:c-more_ea9-t6cl-r_firmware
- automationdirect:c-more_ea9-t6cl_firmware
- automationdirect:c-more_ea9-t8cl_firmware