AutomationDirect DirectLOGIC with Serial Communication Cleartext Transmission
Priority MEDIUM 43CWE-319Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.
Summary
AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to 2.72; D0-06DD2 versions prior to 2.72; D0-06DR versions prior to 2.72; D0-06DA versions prior to 2.72; D0-06AR versions prior to 2.72; D0-06AA versions prior to 2.72; D0-06DD1-D versions prior to 2.72; D0-06DD2-D versions prior to 2.72; D0-06DR-D versions prior to 2.72;
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0077 55th percentileScored 2026-11-07
Fix Fixed DirectLOGIC D0-06 series CPUs (AutomationDirect): 2.72
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AutomationDirect | DirectLOGIC D0-06 series CPUs | D0-06DD1 to before 2.72; D0-06DD2 to before 2.72; D0-06DR to before 2.72; D0-06DA to before 2.72; D0-06AR to before 2.72; D0-06AA to before 2.72; D0-06DD1-D to before 2.72; D0-06DD2-D to before 2.72; D0-06DR-D to before 2.72 | 2.72 | Patch available | CNA |
- DirectLOGIC D0-06 series CPUs VendorAutomationDirect Affected D0-06DD1 to before 2.72; D0-06DD2 to before 2.72; D0-06DR to before 2.72; D0-06DA to before 2.72; D0-06AR to before 2.72; D0-06AA to before 2.72; D0-06DD1-D to before 2.72; D0-06DD2-D to before 2.72; D0-06DR-D to before 2.72 Fixed in 2.72 Patch available CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:automationdirect:d0-06dd1_firmware:*:*:*:*:*:*:*:* | before 2.72 | Vulnerable | AutomationDirect |
| cpe:2.3:h:automationdirect:d0-06dd1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AutomationDirect |
| cpe:2.3:o:automationdirect:d0-06dd2_firmware:*:*:*:*:*:*:*:* | before 2.72 | Vulnerable | AutomationDirect |
| cpe:2.3:h:automationdirect:d0-06dd2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AutomationDirect |
| cpe:2.3:o:automationdirect:d0-06dr_firmware:*:*:*:*:*:*:*:* | before 2.72 | Vulnerable | AutomationDirect |
| cpe:2.3:h:automationdirect:d0-06dr:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AutomationDirect |
| cpe:2.3:o:automationdirect:d0-06da_firmware:*:*:*:*:*:*:*:* | before 2.72 | Vulnerable | AutomationDirect |
| cpe:2.3:h:automationdirect:d0-06da:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AutomationDirect |
| cpe:2.3:o:automationdirect:d0-06ar_firmware:*:*:*:*:*:*:*:* | before 2.72 | Vulnerable | AutomationDirect |
| cpe:2.3:h:automationdirect:d0-06ar:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AutomationDirect |
- cpe:2.3:o:automationdirect:d0-06dd1_firmware:*:*:*:*:*:*:*:* Versions before 2.72 Vulnerable ·AutomationDirect
- cpe:2.3:h:automationdirect:d0-06dd1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
- cpe:2.3:o:automationdirect:d0-06dd2_firmware:*:*:*:*:*:*:*:* Versions before 2.72 Vulnerable ·AutomationDirect
- cpe:2.3:h:automationdirect:d0-06dd2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
- cpe:2.3:o:automationdirect:d0-06dr_firmware:*:*:*:*:*:*:*:* Versions before 2.72 Vulnerable ·AutomationDirect
- cpe:2.3:h:automationdirect:d0-06dr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
- cpe:2.3:o:automationdirect:d0-06da_firmware:*:*:*:*:*:*:*:* Versions before 2.72 Vulnerable ·AutomationDirect
- cpe:2.3:h:automationdirect:d0-06da:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
- cpe:2.3:o:automationdirect:d0-06ar_firmware:*:*:*:*:*:*:*:* Versions before 2.72 Vulnerable ·AutomationDirect
- cpe:2.3:h:automationdirect:d0-06ar:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:automationdirect:d0-06aa_firmware:*:*:*:*:*:*:*:* | before 2.72 | Vulnerable | AutomationDirect |
| cpe:2.3:h:automationdirect:d0-06aa:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AutomationDirect |
| cpe:2.3:o:automationdirect:d0-06dd1-d_firmware:*:*:*:*:*:*:*:* | before 2.72 | Vulnerable | AutomationDirect |
| cpe:2.3:h:automationdirect:d0-06dd1-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AutomationDirect |
| cpe:2.3:o:automationdirect:d0-06dd2-d_firmware:*:*:*:*:*:*:*:* | before 2.72 | Vulnerable | AutomationDirect |
| cpe:2.3:h:automationdirect:d0-06dd2-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AutomationDirect |
| cpe:2.3:o:automationdirect:d0-06dr-d_firmware:*:*:*:*:*:*:*:* | before 2.72 | Vulnerable | AutomationDirect |
| cpe:2.3:h:automationdirect:d0-06dr-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AutomationDirect |
- cpe:2.3:o:automationdirect:d0-06aa_firmware:*:*:*:*:*:*:*:* Versions before 2.72 Vulnerable ·AutomationDirect
- cpe:2.3:h:automationdirect:d0-06aa:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
- cpe:2.3:o:automationdirect:d0-06dd1-d_firmware:*:*:*:*:*:*:*:* Versions before 2.72 Vulnerable ·AutomationDirect
- cpe:2.3:h:automationdirect:d0-06dd1-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
- cpe:2.3:o:automationdirect:d0-06dd2-d_firmware:*:*:*:*:*:*:*:* Versions before 2.72 Vulnerable ·AutomationDirect
- cpe:2.3:h:automationdirect:d0-06dd2-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
- cpe:2.3:o:automationdirect:d0-06dr-d_firmware:*:*:*:*:*:*:*:* Versions before 2.72 Vulnerable ·AutomationDirect
- cpe:2.3:h:automationdirect:d0-06dr-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AutomationDirect
Remediation
- Fix · CNA DirectLOGIC D0-06 series CPUs (AutomationDirect) Fixed in 2.72
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
AutomationDirect DirectLOGIC D0-06 series CPUs 2.72
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2022-01859 AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource ConsumptionPriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2003
- 2026-10-03 Alias added: GHSA-cwvq-v3mj-c66c
References
More AutomationDirect D0-06aa Firmware vulnerabilities
- TI-2022-01859 AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource Consumption CVSS 3.1HIGH 7.5
Sources
- CVE-2022-2003 · CVE Program
- CVE-2022-2003 · NVD
- FIRST EPSS
- GHSA-cwvq-v3mj-c66c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences