CVE-2024-11611: C-more EA9 Firmware RCE Vulnerability

CVE-2024-11611 Overview

CVE-2024-11611 is a memory corruption vulnerability in AutomationDirect C-More EA9 human-machine interface (HMI) programming software. The flaw exists in the parser that handles EAP9 project files. An attacker who convinces an engineer or operator to open a crafted EAP9 file can trigger memory corruption and execute code in the context of the current process. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-24774 and disclosed publicly in ZDI-24-1675. The weakness maps to [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Successful exploitation allows arbitrary code execution on engineering workstations that manage industrial C-More EA9 HMIs, providing a pivot into operational technology (OT) environments.

Affected Products

AutomationDirect C-More EA9 programming software and firmware for panel models EA9-T6CL, EA9-T6CL-R, EA9-T8CL, EA9-T10CL, EA9-T10WCL, EA9-T12CL, EA9-T15CL, and EA9-T15CL-R
AutomationDirect C-More EA9-RHMI remote HMI hardware and firmware
Engineering workstations running vulnerable C-More EA9 programming software that parse EAP9 project files

Discovery Timeline

2025-01-30 - CVE-2024-11611 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11611

Vulnerability Analysis

The vulnerability resides in the routine that parses EAP9 project files inside the C-More EA9 programming environment. EAP9 is a structured project format used to define HMI screens, tag databases, and logic for AutomationDirect C-More panels. The parser fails to properly validate user-supplied fields within the file before using them for memory operations. A malformed field can drive the parser into an out-of-bounds write or similar memory corruption state, corrupting adjacent process memory.

Exploitation requires user interaction. A target engineer or integrator must open the malicious EAP9 file, or visit a page that causes the file to be opened by the associated handler. When triggered, the corruption allows an attacker to redirect execution and run arbitrary code with the privileges of the C-More EA9 process. On engineering workstations, that process often runs with the privileges of the logged-in engineer, providing lateral movement opportunities into the plant network.

Root Cause

The root cause is missing validation of user-supplied data in the EAP9 file parser, classified as [CWE-119]. Length, offset, or index fields taken directly from the file drive memory operations without bounds checks, producing a memory corruption condition that an attacker can shape into control-flow hijack.

Attack Vector

The attack vector is local file parsing with required user interaction. An attacker distributes a crafted EAP9 project file through phishing email, a shared engineering repository, a USB drive, or a compromised integrator handoff. When the target opens the file in vulnerable C-More EA9 software, the malicious payload executes. Refer to the Zero Day Initiative Advisory ZDI-24-1675 and the CERT VDE Bulletin #2182 for vendor-coordinated technical details.

No verified proof-of-concept has been published. Because no public exploit code is available, this article does not include a synthetic sample.

Detection Methods for CVE-2024-11611

Indicators of Compromise

Unexpected .eap9 project files arriving through email, chat, or removable media on engineering workstations
C-More EA9 programming software processes spawning unusual child processes such as cmd.exe, powershell.exe, or scripting hosts
Crashes or abnormal termination of the C-More EA9 process shortly after opening a project file
Outbound network connections from engineering workstations to unfamiliar hosts immediately after project file activity

Detection Strategies

Hunt for process-lineage anomalies where the C-More EA9 executable is the parent of interactive shells, LOLBins, or persistence utilities
Alert on writes of .eap9 files to user Downloads, temporary, or email attachment directories on OT engineering endpoints
Correlate application crash events for C-More EA9 with subsequent process creation or module loads within a short window

Monitoring Recommendations

Enable command-line and image-load logging on engineering workstations and forward events to a centralized analytics platform
Monitor OT segment egress for engineering workstations, which should have narrow, well-known destinations
Track file transfers of .eap9 and other project artifacts crossing the IT/OT boundary

How to Mitigate CVE-2024-11611

Immediate Actions Required

Restrict opening of EAP9 files to trusted internal sources and validate origin before opening any externally supplied project file
Isolate engineering workstations running C-More EA9 software on dedicated OT VLANs with strict egress controls
Apply application allowlisting so that only the C-More EA9 binary and approved tooling execute on those workstations
Review the CERT VDE Bulletin #2182 for vendor guidance and updated software versions

Patch Information

AutomationDirect coordinated disclosure through CERT@VDE and the Zero Day Initiative. Consult the CERT VDE Bulletin #2182 and the Zero Day Initiative Advisory ZDI-24-1675 for the fixed version of C-More EA9 programming software and update instructions. Upgrade all engineering workstations to the patched release before opening untrusted project files.

Workarounds

Do not open EAP9 files received from external parties, email attachments, or unverified USB media on production engineering workstations
Use a disposable virtual machine snapshot with no network access to inspect suspect EAP9 files before importing them into production tooling
Enforce least-privilege accounts for engineers using C-More EA9 to limit the blast radius of code execution

bash

# Example allowlisting rule (Windows AppLocker) restricting C-More EA9 execution
# to signed, expected binaries and blocking script hosts from being spawned by it.
New-AppLockerPolicy -RuleType Publisher `
  -User Everyone `
  -FileInformation (Get-AppLockerFileInformation -Path 'C:\Program Files (x86)\AutomationDirect\C-more EA9\*.exe') `
  -Optimize -Xml | Set-AppLockerPolicy -Merge