Lucene search

[email protected]CVE-2022-2003

HistoryAug 31, 2022 - 4:15 p.m.

CVE-2022-2003

2022-08-3116:15:10

CWE-319

[email protected]

web.nvd.nist.gov

In Wild

automationdirect

directlogic

plc

vulnerability

unauthorized access

serial message

cve-2022-2003

nvd

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.4%

JSON

AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to 2.72; D0-06DD2 versions prior to 2.72; D0-06DR versions prior to 2.72; D0-06DA versions prior to 2.72; D0-06AR versions prior to 2.72; D0-06AA versions prior to 2.72; D0-06DD1-D versions prior to 2.72; D0-06DD2-D versions prior to 2.72; D0-06DR-D versions prior to 2.72;

Affected configurations

NVD

Node

automationdirectd0-06dd1Match-

AND

automationdirectd0-06dd1_firmwareRange<2.72

Node

automationdirectd0-06dd2Match-

AND

automationdirectd0-06dd2_firmwareRange<2.72

Node

automationdirectd0-06drMatch-

AND

automationdirectd0-06dr_firmwareRange<2.72

Node

automationdirectd0-06daMatch-

AND

automationdirectd0-06da_firmwareRange<2.72

Node

automationdirectd0-06arMatch-

AND

automationdirectd0-06ar_firmwareRange<2.72

Node

automationdirectd0-06aaMatch-

AND

automationdirectd0-06aa_firmwareRange<2.72

Node

automationdirectd0-06dd1-dMatch-

AND

automationdirectd0-06dd1-d_firmwareRange<2.72

Node

automationdirectd0-06dd2-dMatch-

AND

automationdirectd0-06dd2-d_firmwareRange<2.72

Node

automationdirectd0-06dr-d_firmwareRange<2.72

AND

automationdirectd0-06dr-dMatch-

CPENameOperatorVersion
automationdirect:d0-06dd1_firmwareautomationdirect d0-06dd1 firmwarelt2.72

CPE	Name	Operator	Version
automationdirect:d0-06dd1_firmware	automationdirect d0-06dd1 firmware	lt	2.72

CNA Affected

[
  {
    "product": "DirectLOGIC D0-06 series CPUs",
    "vendor": "AutomationDirect",
    "versions": [
      {
        "lessThan": "2.72",
        "status": "affected",
        "version": "D0-06DD1",
        "versionType": "custom"
      },
      {
        "lessThan": "2.72",
        "status": "affected",
        "version": "D0-06DD2",
        "versionType": "custom"
      },
      {
        "lessThan": "2.72",
        "status": "affected",
        "version": "D0-06DR",
        "versionType": "custom"
      },
      {
        "lessThan": "2.72",
        "status": "affected",
        "version": "D0-06DA",
        "versionType": "custom"
      },
      {
        "lessThan": "2.72",
        "status": "affected",
        "version": "D0-06AR",
        "versionType": "custom"
      },
      {
        "lessThan": "2.72",
        "status": "affected",
        "version": "D0-06AA",
        "versionType": "custom"
      },
      {
        "lessThan": "2.72",
        "status": "affected",
        "version": "D0-06DD1-D",
        "versionType": "custom"
      },
      {
        "lessThan": "2.72",
        "status": "affected",
        "version": "D0-06DD2-D",
        "versionType": "custom"
      },
      {
        "lessThan": "2.72",
        "status": "affected",
        "version": "D0-06DR-D",
        "versionType": "custom"
      }
    ]
  }
]