Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replay
Vulnerability Description
The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into an ongoing authenticated session. To successfully achieve this, the attacker also needs to spoof both the IP address and MAC address of the originating host which is typical of a session-based attack.
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
使用捕获-重放进行的认证绕过
Vulnerability Title
AutomationDirect DirectLogic H2-DM1E 安全漏洞
Vulnerability Description
AutomationDirect DirectLogic H2-DM1E是AutomationDirect公司的一款可编程逻辑控制器。 AutomationDirect DirectLogic H2-DM1E 2.8.0版本及之前版本存在安全漏洞，该漏洞源于存在会话劫持攻击，如果攻击者捕获会话密钥，他们就可以将流量注入正在进行的认证会话中。
CVSS Information
N/A
Vulnerability Type
N/A