Skip to content
OpenAdvisories
High ICSA-22-167-03 2 CVEs

AutomationDirect DirectLOGIC with Ethernet

Published Jun 16, 2022 · Updated Jun 16, 2022

Vendor: Automation Direct Product: D0-05AA Product: D0-05AD Product: D0-05AR Product: D0-05DA Product: D0-05DD Product: D0-05DD-D Product: D0-05DR Product: D0-05DR-D Product: D0-06AA Product: D0-06AR Product: D0-06DA Product: D0-06DD1 Product: D0-06DD1-D Product: D0-06DD2 Product: D0-06DD2-D Product: D0-06DR Product: D0-06DR-D Product: D2-240 Product: D2-250 Product: D2-250-1 Product: D2-260 Product: D2-262 Product: D4-430 Product: D4-440 Product: D4-450 Product: D4-454

Summary

Successful exploitation of these vulnerabilities could cause a loss of sensitive information, unauthorized changes, and a denial-of-service condition.

Vulnerabilities 2

  • High 7.7
    CVE-2022-2003

    AutomationDirect DirectLOGIC with Serial Communication Cleartext Transmission

    AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes. This issue …

    Automation Direct DirectLOGIC D0-06 series CPUs
  • High 7.5
    CVE-2022-2004

    AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource Consumption

    AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect DirectLOGIC D0-06 s…

    Automation Direct DirectLOGIC D0-06 series CPUs

Revision history

  1. #1

    ICSA-22-167-03 AutomationDirect DirectLOGIC with Ethernet

References