307 matches found
Default credentials
Any attempt good or bad to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets...
Design/Logic Flaw
AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to...
Design/Logic Flaw
AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes. This issue affects: AutomationDirect DirectLOGIC...
Code injection
AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73;...
CVE-2022-2485 AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information
Any attempt good or bad to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets...
CVE-2022-2485 AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information
Any attempt good or bad to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets...
CVE-2022-2485
CVE-2022-2485 – AutomationDirect Stride Field I/O vulnerability affecting Stride Field I/O devices with listed SIO-MB04RTDS, SIO-MB04ADS, SIO-MB04THMS, SIO-MB08ADS-1/2, SIO-MB08THMS, SIO-MB04DAS, SIO-MB12CDR, SIO-MB16CDD2, SIO-MB16ND3 and related batch numbers. Root cause: cleartext transmission ...
CVE-2022-2003
CVE-2022-2003 affects AutomationDirect DirectLOGIC D0-06 series CPUs (D0-06DD1/2/DR/DA/AR/AA and variants) with serial communication prior to firmware version 2.72. Root cause: a specially crafted serial message to the CPU serial port elicits the PLC to respond with the PLC password in cleartext,...
CVE-2022-2003 AutomationDirect DirectLOGIC with Serial Communication Cleartext Transmission
AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes. This issue affects: AutomationDirect DirectLOGIC...
CVE-2022-2004 AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource Consumption
AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to...
CVE-2022-2004 AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource Consumption
AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to...
CVE-2022-2004
The CVE-2022-2004 issue affects AutomationDirect DirectLOGIC D0-06 series CPUs (including D0-06DD1/2/DR/DA/AR/AA and related D0-06DD1-D/D- variants) prior to firmware version 2.72. A specially crafted network packet can exhaust resources in Ethernet modules (H0-ECOM/H0-ECOM100 and related hardwar...
CVE-2022-2005 AutomationDirect C-more EA9 HMI Cleartext Transmission
AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73;...
CVE-2022-2006 AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element
AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to...
CVE-2022-2005
AutomationDirect C-more EA9 HMI contains a vulnerability in its HTTP webserver that transmits credentials in an insecure, cleartext-like mechanism. Affected products include EA9-T6CL/6CL-R, T7CL/7CL-R, T8CL, T10CL/T10WCL, T12CL, T15CL/T15CL-R, RHMI, PGMSW prior to firmware 6.73. Exploitation coul...
CVE-2022-2005 AutomationDirect C-more EA9 HMI Cleartext Transmission
AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73;...
CVE-2022-2006 AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element
AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to...
CVE-2022-2006
CVE-2022-2006 affects AutomationDirect C-more EA9 family (EA9-T6CL/EA9-T6CL-R/EA9-T7CL/EA9-T7CL-R/EA9-T8CL/EA9-T10CL/EA9-T10WCL/EA9-T12CL/EA9-T15CL/EA9-T15CL-R/EA9-RHMI/EA9-PGMSW) and DirectLOGIC prior to firmware 6.73. Root cause: DLL vulnerability in the install directory with an uncontrolled s...
PT-2022-16924 · Automationdirect · Automationdirect Stride Field I/O
Name of the Vulnerable Software and Affected Versions: AutomationDirect Stride Field I/O affected versions not specified Description: The issue allows any attempt to log into the device with a web browser to potentially receive the device's password in the communication packets. Recommendations: ...
CVE-2022-2006: Uncontrolled Search Path Element
AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to...