CVE-2024-45368: AutomationDirect DirectLogic H2-DM1E Session Fixation
The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed anomaly in the H2-DM1E PLC's protocol execution, namely its acceptance of multiple distinct packets as valid authentication responses. This behavior deviates from standard security practices where a single, specific response or encoding pattern is expected for successful authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45368?
CVE-2024-45368 is categorized as a high-severity vulnerability due to its potential impact on the authentication protocol of the H2-DM1E PLC.
How do I fix CVE-2024-45368?
To fix CVE-2024-45368, it is recommended to update the firmware of the AutomationDirect DirectLogic H2-DM1E to the latest version provided by the vendor.
What are the risks associated with CVE-2024-45368?
The risks associated with CVE-2024-45368 include unauthorized access to the H2-DM1E PLC due to potential flaws in its authentication process.
What systems are affected by CVE-2024-45368?
CVE-2024-45368 specifically affects the AutomationDirect DirectLogic H2-DM1E PLC.
Is there a workaround for CVE-2024-45368?
While an official workaround for CVE-2024-45368 may not be provided, securing network access controls can help mitigate the risk until a patch is applied.