CVE-2020-10922

Vulnerability

The vulnerability exists in the EA-HTTP.exe process of C-MORE HMI EA9 touch screen panels running firmware version 6.52. The issue is caused by improper input validation of user requests before processing, allowing an attacker to trigger a denial-of-service condition. [1]

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted network requests to the affected device. No authentication or user interaction is required. The attacker can leverage this to cause the EA-HTTP.exe process to crash, resulting in a denial-of-service state. [1]

Impact

Successful exploitation leads to a denial-of-service condition, rendering the HMI panel unresponsive. This can disrupt industrial control operations relying on the touch screen interface. The impact is limited to availability (C:N/I:N/A:H). [1]

Mitigation

As of the publication date (2020-07-23), no fix has been announced by the vendor. Users should restrict network access to the device, isolate it from untrusted networks, and monitor for future firmware updates from C-MORE. [1]