CVE-2021-32980

Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel

CVSS 9.8 CRITICALEPSS 1.1%CWE-288

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Automation Direct · CLICK PLC CPU Modules: C0-1x CPUs

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02