Automationdirect
50 CVEs across 176 Automationdirect products. Browse Automationdirect vulnerabilities, severities, and proof-of-concept exploits.
Automationdirect products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61378 | Medium | 5.5 | 2026-07-16 | A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash. |
CVE-2026-60073 | Medium | 5.9 | 2026-07-16 | An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system cras… |
CVE-2026-57896 | Medium | 6.1 | 2026-07-16 | An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request… |
CVE-2026-61389 | High | 7.0 | 2026-07-16 | An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, poten… |
CVE-2026-60140 | Medium | 6.1 | 2026-07-16 | An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request… |
CVE-2026-60063 | High | 7.0 | 2026-07-16 | An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, poten… |
CVE-2025-67652 | Medium | 6.1 | 2026-01-22 | An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to syste… |
CVE-2025-25051 | Medium | 6.1 | 2026-01-22 | An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks. |
CVE-2025-60023 | Medium | 4.0 | 2025-10-23 | A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote atta… |
CVE-2025-59776 | Medium | 4.0 | 2025-10-23 | A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote atta… |
CVE-2025-58429 | High | 7.5 | 2025-10-23 | A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote atta… |
CVE-2025-62688 | High | 7.1 | 2025-10-23 | An incorrect permission assignment for a critical resource vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allo… |
CVE-2025-62498 | High | 8.8 | 2025-10-23 | A relative path traversal (ZipSlip) vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an attacker who ca… |
CVE-2025-61977 | High | 7.0 | 2025-10-23 | A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allo… |
CVE-2025-61934 | Critical | 10.0 | 2025-10-23 | A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthentica… |
CVE-2025-58456 | Medium | 6.8 | 2025-10-23 | A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote… |
CVE-2025-58078 | High | 7.5 | 2025-10-23 | A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote… |
CVE-2025-58473 | Medium | 5.9 | 2025-09-23 | An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability… |
CVE-2025-57882 | Medium | 5.9 | 2025-09-23 | An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability… |
CVE-2025-55069 | High | 8.3 | 2025-09-23 | A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies… |
CVE-2025-55038 | Medium | 6.8 | 2025-09-23 | An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the R… |
CVE-2025-59484 | High | 8.3 | 2025-09-23 | The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that t… |
CVE-2025-58069 | Medium | 5.3 | 2025-09-23 | The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software… |
CVE-2025-54855 | Medium | 4.2 | 2025-09-23 | Cleartext storage of sensitive information was discovered in Click Programming Software version v3.60. The vulnerability can be exploited by a local user with… |
CVE-2025-36535 | Critical | 10.0 | 2025-05-21 | The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational di… |
CVE-2025-0960 | Critical | 9.8 | 2025-02-04 | AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an attacker abusing the function to cause a d… |
CVE-2024-11611 | High | 7.8 | 2025-01-30 | AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2024-11610 | High | 7.8 | 2025-01-30 | AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2024-11609 | High | 7.8 | 2025-01-30 | AutomationDirect C-More EA9 EAP9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex… |
CVE-2024-45368 | High | 8.8 | 2024-09-13 | The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed ano… |
CVE-2024-43099 | High | 8.8 | 2024-09-13 | The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such s… |
CVE-2024-24963 | Critical | 9.8 | 2024-05-28 | A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E 1.2.10.9. A spec… |
CVE-2024-24962 | Critical | 9.8 | 2024-05-28 | A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E 1.2.10.9. A spec… |
CVE-2024-24959 | High | 8.2 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Spe… |
CVE-2024-24958 | High | 8.2 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Spe… |
CVE-2024-24957 | High | 8.2 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Spe… |
CVE-2024-24956 | High | 8.2 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Spe… |
CVE-2024-24955 | High | 8.2 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Spe… |
CVE-2024-24954 | High | 8.2 | 2024-05-28 | Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Spe… |
CVE-2024-24947 | High | 8.2 | 2024-05-28 | A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A speciall… |
CVE-2024-24946 | High | 8.2 | 2024-05-28 | A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1.2.10.9. A speciall… |
CVE-2024-24851 | High | 7.5 | 2024-05-28 | A heap-based buffer overflow vulnerability exists in the Programming Software Connection FiBurn functionality of AutomationDirect P3-550E 1.2.10.9. A specially… |
CVE-2024-23601 | Critical | 9.8 | 2024-05-28 | A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted scan_lib.bin can lead to arbi… |
CVE-2024-23315 | High | 7.5 | 2024-05-28 | A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550E 1.2.10.9. A specia… |
CVE-2024-22187 | Critical | 9.1 | 2024-05-28 | A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect P3-550E 1.2.10.9. A… |
CVE-2024-21785 | Critical | 9.8 | 2024-05-28 | A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted series of… |
CVE-2024-25138 | Medium | 6.5 | 2024-03-26 | In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device. |
CVE-2024-25137 | Medium | 4.3 | 2024-03-26 | In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may… |
CVE-2024-25136 | High | 7.5 | 2024-03-26 | There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content. |
CVE-2022-2485 | Critical | 9.6 | 2022-08-31 | Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communi… |
CVE-2022-2006 | High | 7.8 | 2022-08-31 | AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This… |
CVE-2022-2005 | High | 7.5 | 2022-08-31 | AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain… |
CVE-2022-2004 | High | 7.5 | 2022-08-31 | AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devi… |
CVE-2022-2003 | High | 7.7 | 2022-08-31 | AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC pass… |
CVE-2021-32986 | Critical | 9.8 | 2022-04-04 | After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout… |
CVE-2021-32984 | Critical | 9.8 | 2022-04-04 | All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU M… |
CVE-2021-32982 | High | 7.5 | 2022-04-04 | Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An att… |
CVE-2021-32980 | Critical | 9.8 | 2022-04-04 | Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attac… |
CVE-2021-32978 | High | 7.5 | 2022-04-04 | The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful… |
CVE-2020-10922 | High | 7.5 | 2020-07-23 | This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch scre… |
CVE-2020-10921 | Critical | 9.8 | 2020-07-23 | This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authenticat… |
CVE-2020-10920 | Critical | 9.8 | 2020-07-23 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Aut… |
CVE-2020-10919 | Medium | 5.9 | 2020-07-23 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen pan… |
CVE-2020-10918 | High | 7.5 | 2020-07-23 | This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Auth… |
CVE-2020-6969 | Critical | 9.8 | 2020-02-05 | It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More… |
CVE-2016-9335 | Critical | 10.0 | 2018-05-09 | A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride… |
CVE-2017-14020 | High | 7.8 | 2017-11-13 | In AutomationDirect CLICK Programming Software (Part Number C0-PGMSW) Versions 2.10 and prior; C-More Programming Software (Part Number EA9-PGMSW) Versions 6.3… |