CVE-2021-32982 Automation Direct CLICK PLC CPU Modules Cleartext Transmission of Sensitive Information

High 7.5 Published 4 Apr 2022 Updated 16 Apr 2025

Attackers with network visibility can observe plaintext passwords during unlocking and project transfers on Automation Direct CLICK PLC CPU Modules.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-32982?

CVE-2021-32982 is a high-severity vulnerability in Automation Direct CLICK PLC CPU Modules: C0-1x CPUs, published on 4 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange.

Weakness: CWE-319

Which versions are affected by CVE-2021-32982?

It affects 20 products.

Products include Automationdirect C0-10are-D Firmware, Automationdirect C0-10dd1e-D Firmware, Automationdirect C0-10dd2e-D Firmware, Automationdirect C0-10dre-D Firmware, Automationdirect C0-11are-D Firmware, Automationdirect C0-11dd1e-D Firmware and 14 more.

How do I fix CVE-2021-32982?

No fix has been published for CVE-2021-32982 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-32982 being exploited?

There is no known exploitation of CVE-2021-32982 in the wild and no public exploit code.

Sources

Also known as GHSA-qf82-v8c9-p3px.