CVE-2024-43099: AutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replay
The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into an ongoing authenticated session. To successfully achieve this, the attacker also needs to spoof both the IP address and MAC address of the originating host which is typical of a session-based attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43099?
CVE-2024-43099 has a high severity rating due to the potential for session hijacking attacks on authenticated sessions.
How do I fix CVE-2024-43099?
To mitigate CVE-2024-43099, ensure that session keys are securely generated, transmitted over encrypted channels, and regularly rotated.
What products are affected by CVE-2024-43099?
CVE-2024-43099 specifically affects the AutomationDirect DirectLogic H2-DM1E product.
What kind of attack does CVE-2024-43099 involve?
CVE-2024-43099 involves session hijacking, which can allow attackers to gain unauthorized access to a system.
What is the impact of CVE-2024-43099 on security?
The impact of CVE-2024-43099 on security includes the risk of unauthorized control of devices and manipulation of operational processes.