CVE-2020-10921

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-23 · updated 2026-06-17
Weakness: CWE-306

Description

This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. Was ZDI-CAN-10482.

Affected products

C-MORE HMI EA9: 6.52

References

https://www.zerodayinitiative.com/advisories/ZDI-20-807/
https://www.zerodayinitiative.com/advisories/ZDI-20-807/

Get alerted when CVE-2020-10921 or the next vulnerability affects your stack