CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23601
https://notcve.org/view.php?id=CVE-2024-23601
28 May 2024 — A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted scan_lib.bin can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Existe una vulnerabilidad de inyección de código en la funcionalidad scan_lib.bin de AutomationDirect P3-550E 1.2.10.9. Un scan_lib.bin especialmente manipulado puede provocar la ejecución de código arbitrario. • https://community.automationdirect.com/s/internal-database-security-advisory/a4GPE0000003ycL2AQ/sa00039 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2024-25138 – AutomationDirect C-MORE EA9 HMI Plaintext Storage of a Password
https://notcve.org/view.php?id=CVE-2024-25138
26 Mar 2024 — In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device. En AutomationDirect C-MORE EA9 HMI, las credenciales utilizadas por la plataforma se almacenan como texto plano en el dispositivo. • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-256: Plaintext Storage of a Password •
CVSS: 5.0EPSS: 0%CPEs: 11EXPL: 0CVE-2024-25137 – AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow
https://notcve.org/view.php?id=CVE-2024-25137
26 Mar 2024 — In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions. En AutomationDirect C-MORE EA9 HMI hay un programa que copia un búfer de un tamaño controlado por el usuario en un búfer de tamaño limitado en la pila, lo que puede provocar un desbordamiento de la pila. El resultado de este desbordamient... • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-121: Stack-based Buffer Overflow •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 0CVE-2024-25136 – AutomationDirect C-MORE EA9 HMI Path Traversal
https://notcve.org/view.php?id=CVE-2024-25136
26 Mar 2024 — There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content. Hay una función en AutomationDirect C-MORE EA9 HMI que permite a un atacante enviar una ruta relativa en la URL sin una sanitización adecuada del contenido. • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.6EPSS: 0%CPEs: 20EXPL: 0CVE-2022-2485 – AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information
https://notcve.org/view.php?id=CVE-2022-2485
31 Aug 2022 — Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets. Cualquier intento (bueno o malo) de iniciar sesión en AutomationDirect Stride Field I/O con un navegador web puede hacer que el dispositivo responda con su contraseña en los paquetes de comunicación • https://cdn.automationdirect.com/static/firmware/product_advisory/PA-COM-006.pdf • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 0CVE-2022-2004 – AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource Consumption
https://notcve.org/view.php?id=CVE-2022-2004
31 Aug 2022 — AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to 2.72; D0-06DD2 versions prior to 2.72; D0-06DR versions prior to 2.72; D0-06DA versions prior to 2.72; D0-06AR versions prior to 2.72; D0-06AA versions prior to 2.72; D0-06DD1-D versions prior to 2.72; D0-06DD2-D ve... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-03 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.4EPSS: 0%CPEs: 18EXPL: 0CVE-2022-2003 – AutomationDirect DirectLOGIC with Serial Communication Cleartext Transmission
https://notcve.org/view.php?id=CVE-2022-2003
31 Aug 2022 — AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to 2.72; D0-06DD2 versions prior to 2.72; D0-06DR versions prior to 2.72; D0-06DA versions prior to 2.72; D0-06AR versions prior to 2.72; D0-06AA versions prior to 2.72; D0-... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-02 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.8EPSS: 0%CPEs: 24EXPL: 0CVE-2022-2006 – AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element
https://notcve.org/view.php?id=CVE-2022-2006
31 Aug 2022 — AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 24EXPL: 0CVE-2022-2005 – AutomationDirect C-more EA9 HMI Cleartext Transmission
https://notcve.org/view.php?id=CVE-2022-2005
31 Aug 2022 — AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL version... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 40EXPL: 0CVE-2021-32982 – Automation Direct CLICK PLC CPU Modules Cleartext Transmission of Sensitive Information
https://notcve.org/view.php?id=CVE-2021-32982
04 Apr 2022 — Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange. Módulos de CPU de PLC CLICK de Automation Direct: CPUs C0-1x con versiones de firmware anteriores a v3.00, las contraseñas son enviadas como texto plano durante el desbloqueo y las transferencias de proyectos. Un atacante que tenga visibilidad de la red puede observar el intercambio d... • https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02 • CWE-319: Cleartext Transmission of Sensitive Information •