CVE-2021-32980: Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
Published Apr 4, 2022
·Updated
Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active.
Affected Software
41 affected components
Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with All firmware prior to v3.00
AutomationDirect C0-10dd1e-d Firmware<3.00
AutomationDirect C0-10dd1e-d
AutomationDirect C0-10dd2e-d Firmware<3.00
AutomationDirect C0-10dd2e-d
AutomationDirect C0-10dre-d Firmware<3.00
AutomationDirect C0-10dre-d
AutomationDirect C0-10are-d Firmware<3.00
AutomationDirect C0-10are-d
AutomationDirect C0-11dd1e-d Firmware<3.00
AutomationDirect C0-11dd1e-d
AutomationDirect C0-11dd2e-d Firmware<3.00
AutomationDirect C0-11dd2e-d
AutomationDirect C0-11dre-d Firmware<3.00
AutomationDirect C0-11dre-d
AutomationDirect C0-11are-d Firmware<3.00
AutomationDirect C0-11are-d
AutomationDirect C0-12dd1e-d Firmware<3.00
AutomationDirect C0-12dd1e-d
AutomationDirect C0-12dd2e-d Firmware<3.00
AutomationDirect C0-12dd2e-d
AutomationDirect C0-12dre-d Firmware<3.00
AutomationDirect C0-12dre-d
AutomationDirect C0-12are-d Firmware<3.00
AutomationDirect C0-12are-d
AutomationDirect C0-12dd1e-1-d Firmware<3.00
AutomationDirect C0-12dd1e-1-d
AutomationDirect C0-12dd2e-1-d Firmware<3.00
AutomationDirect C0-12dd2e-1-d
AutomationDirect C0-12dre-1-d Firmware<3.00
AutomationDirect C0-12dre-1-d
AutomationDirect C0-12are-1-d Firmware<3.00
AutomationDirect C0-12are-1-d
AutomationDirect C0-12dd1e-2-d Firmware<3.00
AutomationDirect C0-12dd1e-2-d
AutomationDirect C0-12dd2e-2-d Firmware<3.00
AutomationDirect C0-12dd2e-2-d
AutomationDirect C0-12dre-2-d Firmware<3.00
AutomationDirect C0-12dre-2-d
AutomationDirect C0-12are-2-d Firmware<3.00
AutomationDirect C0-12are-2-d
Remediation
Information
Automation Direct reports these vulnerabilities are all mitigated by Version 3.00 and recommends users update software and firmware to the latest version.
Automation Direct also recommends users follow its security guidelines.
Event History
Apr 4, 2022
CVE Published
via MITRE·07:45 PM
Data Sourced
via MITRE·07:45 PM
RemedyDescriptionSeverityWeakness
Aug 3, 2024
Data Sourced
via ICS·11:42 PM
SeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-32980.
2
What is the severity of CVE-2021-32980?
CVE-2021-32980 has a severity rating of 9.8, which is classified as critical.
3
What is the affected software for CVE-2021-32980?
The affected software for CVE-2021-32980 is Automation Direct CLICK PLC CPU Modules with firmware versions prior to v3.00.
4
How does CVE-2021-32980 impact the affected software?
CVE-2021-32980 allows an attacker to connect to the PLC while an existing connection is already active, compromising the security of the system.
5
Is there a fix available for CVE-2021-32980?
Yes, upgrading the firmware to version 3.00 or higher will fix the vulnerability.