Skip to content
OpenAdvisories
High ICSA-24-256-17 2 CVEs

AutomationDirect DirectLogic H2-DM1E

Published Sep 12, 2024 · Updated Sep 12, 2024

Vendor: Automation Direct Product: DirectLogic H2-DM1E

Summary

Successful exploitation of these vulnerabilities could allow an attacker to inject traffic into an ongoing authenticated session or authenticate as a valid user.

Vulnerabilities 2

  • High 8.8
    CVE-2024-43099

    AutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replay

    The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this sessi…

    Automation Direct DirectLogic H2-DM1E
  • High 8.8
    CVE-2024-45368

    AutomationDirect DirectLogic H2-DM1E Session Fixation

    The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed anomaly in the H2-DM1E PLC's protocol execution, namely its acceptance of multiple distinct packets as …

    Automation Direct DirectLogic H2-DM1E

Revision history

  1. #1

    Initial Publication

References