CVE-2021-32980
Assigner: icscert
Published: 2022-04-04T19:45:52
State: PUBLISHED
affected: product: CLICK PLC CPU Modules: C0-1x CPUs
vendor: Automation Direct
versions: lessThan: 3.00
status: affected
version: unspecified
versionType: custom
credits: value: Irfan Ahmed and Adeen Ayub of Virginia Commonwealth University and Hyunguk Yoo of the University of New Orleans reported these vulnerabilities to Automation Direct.
descriptions: value: Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
type: CWE
solutions: value: Automation Direct reports these vulnerabilities are all mitigated by Version 3.00 and recommends users update software and firmware to the latest version.

Automation Direct also recommends users follow its security guidelines.
source: advisory: ICSA-21-166-02
discovery: EXTERNAL
title: Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
x_generator: engine: Vulnogram 0.0.9