High severity · published Aug 31, 2022
CVE-2022-2006
AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
C-more EA9 · AutomationDirect
EA9-T6CL before 6.73; EA9-T6CL-R before 6.73; EA9-T7CL before 6.73; EA9-T7CL-R before 6.73; EA9-T8CL before 6.73; EA9-T10CL before 6.73; +5 more · source: vendor
Affected product
CE
C-more EA9
AutomationDirect
More from C-more EA9
7.8
CVE-2024-11611
AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability
7.8
CVE-2024-11610
AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability
7.8
CVE-2024-11609
AutomationDirect C-More EA9 EAP9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
7.5
CVE-2022-2005
AutomationDirect C-more EA9 HMI Cleartext Transmission