CVE-2021-32980

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...

CVE-2021-32978

The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00...

CVE-2021-32980

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...

Design/Logic Flaw

The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00...

Authentication flaw

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...

Buffer overflow

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange...

Authorization

All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, an attacker can connect to the PLC and read the project...

CVE-2021-32986

The CVE affects Automation Direct CLICK PLC CPU Modules (C0-1x CPUs) with firmware prior to v3.00. The vulnerability is an authentication bypass where, once an authorized user unlocks the PLC, the unlocked state does not timeout and remains usable if the programming software is interrupted; all s...

CVE-2021-32978

The CVE-2021-32978 entry describes a vulnerability in Automation Direct CLICK PLC CPU Modules (C0-1x) with firmware prior to v3.00 where a previously entered password and lock state can be read from the programming protocol, effectively exposing credentials and enabling unlocks if the password wa...

CVE-2021-32980 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...

CVE-2021-32980 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...

PT-2022-10178 · Automationdirect · Automation Direct Click Plc Cpu Modules

Name of the Vulnerable Software and Affected Versions: Automation Direct CLICK PLC CPU Modules: C0-1x CPUs versions prior to v3.00 Description: The issue arises when an authorized user unlocks the Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00. The unlocked state...

PT-2022-10175

Name of the Vulnerable Software and Affected Versions Automation Direct CLICK PLC CPU Modules versions prior to v3.00 Description The issue concerns the transmission of passwords in plaintext during unlocking and project transfers for Automation Direct CLICK PLC CPU Modules. An attacker with...

PT-2022-10176

Name of the Vulnerable Software and Affected Versions Automation Direct CLICK PLC CPU Modules: C0-1x CPUs versions prior to v3.00 Description The issue allows an attacker to connect to the PLC and read the project without authorization during the time it is unlocked by an authorized user, resulti...

PT-2022-10172

Name of the Vulnerable Software and Affected Versions Automation Direct CLICK PLC CPU Modules: C0-1x CPUs versions prior to v3.00 Description The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was...

CVE-2021-32982: Cleartext Transmission of Sensitive Information

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange...

CVE-2021-32986: Authentication Bypass Using an Alternate Path or Channel

After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout. If the programming software is interrupted, the PLC remains unlocked. All subsequent programming connections are allowed without...

CVE-2021-32984: Authentication Bypass Using an Alternate Path or Channel

All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, an attacker can connect to the PLC and read the project...

CVE-2021-32978: Plaintext Storage of a Password

The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00...

CVE-2021-32980: Authentication Bypass Using an Alternate Path or Channel

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...