CVE-2021-32978 Automation Direct CLICK PLC CPU Modules Plaintext Storage of a Password

High 7.5 Published 4 Apr 2022 Updated 16 Apr 2025

Attackers can read stored passwords via the programming protocol to unlock Automation Direct CLICK PLC CPU modules.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-32978?

CVE-2021-32978 is a high-severity vulnerability in Automation Direct CLICK PLC CPU Modules: C0-1x CPUs, published on 4 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00.

Weakness: CWE-522, CWE-256

Which versions are affected by CVE-2021-32978?

It affects 20 products.

Products include Automationdirect C0-10are-D Firmware, Automationdirect C0-10dd1e-D Firmware, Automationdirect C0-10dd2e-D Firmware, Automationdirect C0-10dre-D Firmware, Automationdirect C0-11are-D Firmware, Automationdirect C0-11dd1e-D Firmware and 14 more.

How do I fix CVE-2021-32978?

No fix has been published for CVE-2021-32978 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-32978 being exploited?

There is no known exploitation of CVE-2021-32978 in the wild and no public exploit code.

Sources

Also known as GHSA-pjv9-rw8r-7262.