PT-2022-10178 · Automationdirect · Automation Direct Click Plc Cpu Modules

Adeen Ayub + 2 · Published 2022-04-04 · Updated 2022-10-25 · CVE-2021-32986

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Automation Direct CLICK PLC CPU Modules: C0-1x CPUs versions prior to v3.00

Description The issue arises when an authorized user unlocks the Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00. The unlocked state does not timeout, and if the programming software is interrupted, the PLC remains unlocked, allowing all subsequent programming connections without authorization. The PLC is only relocked by a power cycle or when the programming software disconnects correctly.

Recommendations For versions prior to v3.00, update the firmware to v3.00 or later to resolve the issue. As a temporary workaround, consider performing a power cycle after each use of the programming software to ensure the PLC is relocked. Additionally, ensure the programming software disconnects correctly to prevent unauthorized access.

Fix

Authentication Bypass Using an Alternate Path or Channel

Incorrect Authorization

Weakness Enumeration

CWE-288

CWE-863

Related Identifiers

CVE-2021-32986

Affected Products

Automation Direct Click Plc Cpu Modules

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-32986 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32986 · Vendor Advisory
• https://t.me/cibsecurity/40137 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-166-02 · Note