CVE-2025-0960
Published: 04 February 2025
Summary
CVE-2025-0960 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Automationdirect (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
AutomationDirect C-more EA9 HMI devices are affected by CVE-2025-0960, a bounds-checking flaw in a network-accessible function that can be bypassed. The issue is tracked under CWE-120 and carries a CVSS 4.0 score of 9.3, reflecting network attack vector, low complexity, and no required authentication or user interaction. Successful abuse can corrupt memory and lead to either a denial-of-service condition or remote code execution on the target HMI.
An unauthenticated attacker with network reachability to an exposed EA9 device can send crafted input that skips the intended bounds checks. This allows the attacker to overwrite adjacent memory regions, resulting in either a crash of the HMI application or execution of arbitrary code with the privileges of the process.
Vendor and government advisories have been published at the AutomationDirect cybersecurity community page and in CISA advisory ICSA-25-035-08; these documents outline mitigation steps for affected deployments. The associated EPSS score remains low, with a current value of 0.0302 and a recorded peak of 0.0350.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1945
Vulnerability details
AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an attacker abusing the function to cause a denial-of-service condition or achieving remote code execution on the affected device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow (CWE-120) in network-accessible HMI enables unauthenticated remote exploitation for RCE/DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely flaw remediation, directly addressing the buffer overflow vulnerability by requiring application of vendor patches for the skipped bounds checks.
SI-10 enforces comprehensive input validation at all entry points, preventing exploitation of the function's skippable bounds checks leading to buffer copy without size verification.
SI-16 implements memory protections such as ASLR and non-executable memory to mitigate remote code execution resulting from the buffer overflow vulnerability.