CVE-2024-45368CWE-384

AutomationDirect DirectLogic H2-DM1E Session Fixation

High · published September 13, 2024

CVSS v4.0
8.7
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed anomaly in the H2-DM1E PLC's protocol execution, namely its acceptance of multiple distinct packets as valid authentication responses. This behavior deviates from standard security practices where a single, specific response or encoding pattern is expected for successful authentication.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00342 · 26.5th percentile
Weakness
CWE-384 · Session Fixation
Published
2024-09-13T16:36Z
EPSS history
Timeline
  • 13 SEP 16:36Z
    AutomationDirect DirectLogic H2-DM1E Session Fixation
    cvelistv5