Critical · published April 4, 2022
🚨 An unprotected programming connection in Automation Direct CLICK PLCs could let an attacker take control while you're still connected! 🔥 Think of it like leaving your front door wide open while you’re already hosting a party inside. Someone could just wander in without you noticing, taking over the festivities (or in this case, your PLC controls!). With an attacker gaining access, they could potentially manipulate processes, disrupt operations, or even cause catastrophic failures. The implications are absolutely devastating, putting not just systems, but also safety at risk.
Think of it like leaving your front door wide open while you’re already hosting a party inside. Someone could just wander in without you noticing, taking over the festivities (or in this case, your PLC controls!). This vulnerability arises because C0-1x CPUs running firmware before version 3.00 fail to protect against additional programming connections, allowing unauthorized access while legitimate sessions are still active.
With an attacker gaining access, they could potentially manipulate processes, disrupt operations, or even cause catastrophic failures. The implications are absolutely devastating, putting not just systems, but also safety at risk. Upgrade your PLC firmware to version 3.00 or higher immediately to close this gaping hole. Implement strict network access controls to limit who can connect to your PLCs in the future. You’ve got this! With these steps, you can secure your systems and maintain control. 🛡️