CVE-2021-32978

Published: Apr 4, 2022Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00.

Affected (20)

Products: Automationdirect: C0 10dd1e D Firmware, C0 10dd2e D Firmware, C0 10dre D Firmware, C0 10are D Firmware, C0 11dd1e D Firmware, C0 11dd2e D Firmware, C0 11dre D Firmware, C0 11are D Firmware, C0 12dd1e D Firmware, C0 12dd2e D Firmware, C0 12dre D Firmware, C0 12are D Firmware, C0 12dd1e 1 D Firmware, C0 12dd2e 1 D Firmware, C0 12dre 1 D Firmware, C0 12are 1 D Firmware, C0 12dd1e 2 D Firmware, C0 12dd2e 2 D Firmware, C0 12dre 2 D Firmware, C0 12are 2 D Firmware

20 products

C0 12dd1e 1 D Firmware

C0 12dd2e 1 D Firmware

C0 12dre 1 D Firmware

C0 12are 1 D Firmware

C0 12dd1e 2 D Firmware

C0 12dd2e 2 D Firmware

C0 12dre 2 D Firmware

C0 12are 2 D Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 10dd1e D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 10dd1e D	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 10dd2e D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 10dd2e D	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 10dre D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 10dre D	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 10are D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 10are D	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 11dd1e D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 11dd1e D	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 11dd2e D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 11dd2e D	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 11dre D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 11dre D	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 11are D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 11are D	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12dd1e D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12dd1e D	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12dd2e D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12dd2e D	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12dre D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12dre D	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12are D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12are D	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12dd1e 1 D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12dd1e 1 D	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12dd2e 1 D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12dd2e 1 D	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12dre 1 D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12dre 1 D	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12are 1 D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12are 1 D	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12dd1e 2 D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12dd1e 2 D	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12dd2e 2 D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12dd2e 2 D	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12dre 2 D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12dre 2 D	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Automationdirect C0 12are 2 D Firmware	Before 3.00

Running on/with	Platform Versions
Automationdirect C0 12are 2 D	All versions

Related CWEs

CWE-256

Plaintext Storage of a Password

Storing a password in plaintext may result in a system compromise.

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (2)

https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.