Automationdirect c0-12dd2e-2-D Firmware vulnerabilities

5 CVEs affecting Automationdirect c0-12dd2e-2-D Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-32986, published 2022-04-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-32986, published 2022-04-04. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout. If the programming software is…
CVE-2021-32984, published 2022-04-04. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior…
CVE-2021-32980, published 2022-04-04. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an…
CVE-2021-32978, published 2022-04-04. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password…
CVE-2021-32982, published 2022-04-04. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can…