CVE-2022-2004 : Exploit Details and Defense Strategies

AutomationDirect DirectLOGIC with Ethernet Communication is vulnerable to uncontrolled resource consumption. An attacker can exploit this vulnerability by sending a specially crafted packet to the PLC, leading to a denial-of-service condition.

Understanding CVE-2022-2004

This CVE affects AutomationDirect DirectLOGIC D0-06 series CPUs with versions prior to 2.72.

What is CVE-2022-2004?

CVE-2022-2004 is a vulnerability in AutomationDirect DirectLOGIC that allows an attacker to send malicious packets to the PLC, causing a denial-of-service condition.

The Impact of CVE-2022-2004

The vulnerability can result in a denial-of-service condition, preventing access from DirectSoft and other devices to the affected PLCs.

Technical Details of CVE-2022-2004

Vulnerability Description

The vulnerability in AutomationDirect DirectLOGIC allows uncontrolled resource consumption by sending specially crafted packets to the PLC.

Affected Systems and Versions

DirectLOGIC D0-06DD1 versions prior to 2.72
DirectLOGIC D0-06DD2 versions prior to 2.72
DirectLOGIC D0-06DR versions prior to 2.72
DirectLOGIC D0-06DA versions prior to 2.72
DirectLOGIC D0-06AR versions prior to 2.72
DirectLOGIC D0-06AA versions prior to 2.72
DirectLOGIC D0-06DD1-D versions prior to 2.72
DirectLOGIC D0-06DD2-D versions prior to 2.72
DirectLOGIC D0-06DR-D versions prior to 2.72

Exploitation Mechanism

The vulnerability can be exploited by continuously sending malicious packets to the PLC, causing a denial-of-service condition.

Mitigation and Prevention

Immediate Steps to Take

AutomationDirect recommends users to upgrade to firmware Version 2.72 or later for all DL06 CPUs affected by CVE-2022-2004. Additional brute force mitigation for password access has also been added.

Long-Term Security Practices

Users of PLCs, HMI products, and other SCADA system products should perform independent network security analysis to determine the proper level of security required for the application.

Patching and Updates

AutomationDirect has identified specific mitigation actions including securing physical access, isolating networks, and considering newer PLC families for enhanced security.