AutomationDirect DirectLOGIC prior 6.73 Installation uncontrolled search path

Summaryinfo

A vulnerability was found in AutomationDirect DirectLOGIC. It has been declared as very critical. This affects an unknown part of the component Installation. Executing a manipulation can lead to uncontrolled search path. This vulnerability is tracked as CVE-2022-2006. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in AutomationDirect DirectLOGIC (Automation Software). It has been declared as very critical. This vulnerability affects some unknown processing of the component Installation. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. The CWE definition for the vulnerability is CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;

The weakness was disclosed 09/01/2022 as icsa-22-167-01. The advisory is available at cisa.gov. This vulnerability was named CVE-2022-2006 since 06/06/2022. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/01/2022). This vulnerability is assigned to T1574 by the MITRE ATT&CK project.

Upgrading to version 6.73 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Automation Software

Vendor

• AutomationDirect

Name

• DirectLOGIC

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion