PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-11611 AutomationDirect CVE debrief

A file parsing memory corruption vulnerability in AutomationDirect C-More EA9 Programming Software allows remote code execution through crafted file processing. The vulnerability stems from unsafe data handling during file parsing operations, enabling memory corruption that can be exploited to execute arbitrary code on the target system. This affects C-More EA9 Programming Software versions 6.78 and earlier. CISA published advisory ICSA-24-340-01 on December 5, 2024, coordinating disclosure with the vendor.

Vendor
AutomationDirect
Product
C-More EA9 Programming Software
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-12-05
Original CVE updated
2024-12-05
Advisory published
2024-12-05
Advisory updated
2024-12-05

Who should care

Organizations using AutomationDirect C-More EA9 HMI systems in industrial environments, particularly manufacturing, process control, and building automation sectors where these HMIs are deployed for operator interface and machine control.

Technical summary

The vulnerability exists in the file parsing functionality of AutomationDirect C-More EA9 Programming Software versions 6.78 and earlier. Insufficient input validation during file processing leads to memory corruption conditions that can be triggered by malformed files. Successful exploitation enables arbitrary code execution in the context of the application. The attack requires local access with user interaction (opening a malicious file), but the impact is severe with complete system compromise possible.

Defensive priority

HIGH

Recommended defensive actions

  • Update C-More EA9 Programming Software to version 6.79 or later to remediate this vulnerability.
  • If immediate patching is not feasible, disconnect affected workstations from external networks including internet and corporate LAN.
  • Implement network segmentation using dedicated secure internal networks or air-gapped systems for programmable device communication.
  • Restrict physical and logical workstation access to authorized personnel only.
  • Deploy multi-factor authentication and enforce robust password policies for all user accounts.
  • Implement application whitelisting to permit only pre-approved trusted software execution.
  • Deploy antivirus or endpoint detection and response (EDR) tools for threat monitoring and mitigation.
  • Configure host-based firewalls to block unauthorized access attempts.

Evidence notes

CISA CSAF advisory ICSA-24-340-01 provides the authoritative technical description and remediation guidance. CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates local attack vector with user interaction required, but successful exploitation yields complete confidentiality, integrity, and availability compromise.

Official resources

Coordinated disclosure via CISA ICS advisory ICSA-24-340-01 published December 5, 2024.