CVE-2024-25136

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
AutomationDirectC-MORE EA9 HMI EA9-T6CL<= 6.77
AutomationDirectC-MORE EA9 HMI EA9-T7CL<= 6.77
AutomationDirectC-MORE EA9 HMI EA0-T7CL-R<= 6.77
AutomationDirectC-MORE EA9 HMI EA9-T8CL<= 6.77
AutomationDirectC-MORE EA9 HMI EA9-T10CL<= 6.77
AutomationDirectC-MORE EA9 HMI EA9-T10WCL<= 6.77
AutomationDirectC-MORE EA9 HMI EA9-T12CL<= 6.77
AutomationDirectC-MORE EA9 HMI EA9-T15CL<= 6.77
AutomationDirectC-MORE EA9 HMI EA9-T15CL-R<= 6.77
AutomationDirectC-MORE EA9 HMI EA9-RHMI<= 6.77
AutomationDirectC-MORE EA9 HMI EA9-PGMSW<= 6.77
automationdirectc-more_ea9-t6cl_firmware<= 6.77
automationdirectc-more_ea9-t7cl_firmware<= 6.77
automationdirectc-more_ea9-t7cl-r_firmware<= 6.77
automationdirectc-more_ea9-t8cl_firmware<= 6.77
automationdirectc-more_ea9-t10cl_firmware<= 6.77
automationdirectc-more_ea9-t10wcl_firmware<= 6.77
automationdirectc-more_ea9-t12cl_firmware<= 6.77
automationdirectc-more_ea9-t15cl_firmware<= 6.77
automationdirectc-more_ea9-t15cl-r_firmware<= 6.77
automationdirectc-more_ea9-rhmi_firmware<= 6.77
automationdirectc-more_ea9-pgmsw_firmware<= 6.77

References

Timeline

Published
Mar 26, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-251374.3In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on tCVE-2024-251386.5In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device.CVE-2024-2513910.0In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffeCVE-2024-25149.8A vulnerability classified as critical was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected by this vulnerabilCVE-2024-251409.8A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with EnhanCVE-2024-251419.1When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was CVE-2024-251425.5Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.  Airflow did not return "Cache-Control" header fCVE-2024-251436.5The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service packCVE-2024-251446.5The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 beforeCVE-2024-251455.4Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, anCVE-2024-251465.3Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and oCVE-2024-251476.1Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and
CVE-2024-25136: High severity, CVSS 7.5 | Vulnix