by Kastro
Paper/Archive/CVE-2022-2485

CVE-2022-2485

AutomationDirect SIO-MB04RTDS — AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information

EPSS 0.5%CVSS 9.6
critical.is priorityof 100
38
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 46.0.460 × 209.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets.

Affected

ProductAffectedFixed inSource
SIO-MB04RTDSunspecified – < 8.3.4.08.3.4.0CNA
SIO- MB04ADSunspecified – < 8.4.3.08.4.3.0CNA
SIO-MB04THMSunspecified – < 8.5.4.08.5.4.0CNA
SIO-MB08ADS-1unspecified – < 8.6.3.08.6.3.0CNA
SIO-MB08ADS-2unspecified – < 8.7.3.08.7.3.0CNA
SIO-MB08THMSunspecified – < 8.8.4.08.8.4.0CNA
SIO-MB04DASunspecified – < 8.11.3.08.11.3.0CNA
SIO-MB12CDRunspecified – < 8.0.4.08.0.4.0CNA
SIO-MB16CDD2unspecified – < 8.1.4.08.1.4.0CNA
SIO-MB16ND3unspecified – < 8.2.4.008.2.4.00CNA
SIO-MB12CDRbatch number (B/N) 5714442222–CNA
SIO-MB04ADSB/N 5714442222–CNA

Scores by source

icscert (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-22-202-05refcdn.automationdirect.com/static/firmware/product_advisory/PA-COM-006.pdf