CVE-2024-11610 AutomationDirect CVE debrief

Who should care

Organizations using AutomationDirect C-More EA9 HMI systems in industrial control environments, particularly manufacturing, process control, and building automation sectors. System integrators, OT security teams, and plant engineers responsible for HMI programming workstations should prioritize patching. Critical infrastructure operators with air-gapped or isolated networks should still apply updates due to potential supply chain or removable media attack vectors.

Technical summary

The vulnerability exists in the file parsing functionality of AutomationDirect C-More EA9 Programming Software versions 6.78 and earlier. Insufficient validation of file data during parsing leads to memory corruption, which can be exploited to execute arbitrary code. The attack requires local access and user interaction (opening a malicious file), but successful exploitation results in complete system compromise with high impact on confidentiality, integrity, and availability. The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) or similar memory corruption weakness.

Defensive priority

HIGH

Recommended defensive actions

• Update AutomationDirect C-More EA9 Programming Software to version 6.79 immediately
• If immediate update is not feasible, disconnect affected workstations from external networks (internet and corporate LAN)
• Use dedicated secure internal networks or air-gapped systems for communication with programmable devices
• Restrict physical and logical access to authorized personnel only
• Implement multi-factor authentication and robust password policies
• Deploy application whitelisting to allow only pre-approved trusted software
• Use antivirus or endpoint detection and response (EDR) tools for threat monitoring
• Ensure host-based firewalls are properly configured to block unauthorized access

Evidence notes

Vulnerability disclosed via CISA CSAF advisory ICSA-24-340-01 on 2024-12-05. Affected product confirmed as AutomationDirect C-More EA9 Programming Software versions 6.78 and earlier. CVSS 3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Vendor remediation available in version 6.79.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.