← back
CVE-2022-2485

AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information

CVSS 9.6 CRITICALEPSS 0.4%CWE-319
Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
AutomationDirect · SIO- MB04ADSAutomationDirect · SIO-MB04ADSAutomationDirect · SIO-MB04DASAutomationDirect · SIO-MB04RTDSAutomationDirect · SIO-MB04THMSAutomationDirect · SIO-MB08ADS-1AutomationDirect · SIO-MB08ADS-2AutomationDirect · SIO-MB08THMSAutomationDirect · SIO-MB12CDRAutomationDirect · SIO-MB16CDD2AutomationDirect · SIO-MB16ND3

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://cdn.automationdirect.com/static/firmware/product_advisory/PA-COM-006.pdfhttps://www.cisa.gov/uscert/ics/advisories/icsa-22-202-05