1. Home
  2. CVE Database
  3. CVE-2022-2005
HIGH · 7.5

CVE-2022-2005

AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a val...

Vulnerability Description

AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
AutomationdirectC-More Ea9-T6Cl Firmware< 6.73
AutomationdirectC-More Ea9-T6Cl-
AutomationdirectC-More Ea9-T6Cl-R Firmware< 6.73
AutomationdirectC-More Ea9-T6Cl-R-
AutomationdirectC-More Ea9-T7Cl Firmware< 6.73
AutomationdirectC-More Ea9-T7Cl-
AutomationdirectC-More Ea9-T7Cl-R Firmware< 6.73
AutomationdirectC-More Ea9-T7Cl-R-
AutomationdirectC-More Ea9-T8Cl Firmware< 6.73
AutomationdirectC-More Ea9-T8Cl-
AutomationdirectC-More Ea9-T10Cl Firmware< 6.73
AutomationdirectC-More Ea9-T10Cl-
AutomationdirectC-More Ea9-T10Wcl Firmware< 6.73
AutomationdirectC-More Ea9-T10Wcl-
AutomationdirectC-More Ea9-T12Cl Firmware< 6.73
AutomationdirectC-More Ea9-T12Cl-
AutomationdirectC-More Ea9-T15Cl Firmware< 6.73
AutomationdirectC-More Ea9-T15Cl-
AutomationdirectC-More Ea9-T15Cl-R Firmware< 6.73
AutomationdirectC-More Ea9-T15Cl-R-

Related Weaknesses (CWE)

CWE-319

References

FAQ

What is CVE-2022-2005?

CVE-2022-2005 is a vulnerability with a CVSS score of 7.5 (HIGH). AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a val...

How severe is CVE-2022-2005?

CVE-2022-2005 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-2005?

Check the references section above for vendor advisories and patch information. Affected products include: Automationdirect C-More Ea9-T6Cl Firmware, Automationdirect C-More Ea9-T6Cl, Automationdirect C-More Ea9-T6Cl-R Firmware, Automationdirect C-More Ea9-T6Cl-R, Automationdirect C-More Ea9-T7Cl Firmware.