Improper Authentication in CLICK PLC CPU Module C0-1x CPUs - CVE-2021-32984
Published: June 17, 2021
Vulnerability identifier: #VU54183
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-32984
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to all programming connections receive the same unlocked privileges. A remote attacker can connect to the PLC and read the project without authorization, during the time the PLC is unlocked by an authorized user.
Affected software
CLICK PLC CPU Module C0-1x CPUs
How to mitigate CVE-2021-32984
Install updates from vendor's website.
CLICK PLC CPU Module C0-1x CPUs - update to 3.00