Vendor
Automation Direct
61 known vulnerabilities.
Products
61 results · Feed
-
Critical 9.8
A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of A…
-
Critical 9.8
A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of A…
-
High 7.5
A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of Aut…
-
Critical 9.1
A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality …
-
Critical 9.8
A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E…
-
Critical 9.8
A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. A special…
-
Medium 6.5
AutomationDirect C-MORE EA9 HMI Plaintext Storage of a Password
In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device.
-
Medium 4.3
AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow
In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-servi…
-
High 7.5
AutomationDirect C-MORE EA9 HMI Path Traversal
There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content.
-
Critical 9.6
AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information
Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets.
-
High 7.7
AutomationDirect DirectLOGIC with Serial Communication Cleartext Transmission
AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes. This issue …
-
High 7.5
AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource Consumption
AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect DirectLOGIC D0-06 s…
-
High 7.8
AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element
AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prio…
-
High 7.5
AutomationDirect C-more EA9 HMI Cleartext Transmission
AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA…
-
High 7.5
Automation Direct CLICK PLC CPU Modules Cleartext Transmission of Sensitive Information
Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange.
-
Critical 9.8
Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout. If the programming software is interrupted, the PLC remains unlocked. All subsequent programming con…
-
Critical 9.8
Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, an attacker can c…
-
High 7.5
Automation Direct CLICK PLC CPU Modules Plaintext Storage of a Password
The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs…
-
Critical 9.8
Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active.
-
Unscored —
A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches run…
-
Unscored —
In AutomationDirect CLICK Programming Software (Part Number C0-PGMSW) Versions 2.10 and prior; C-More Programming Softw…