Threadlinqs IntelligenceStart free

VulnerabilityCVE-2022-2003Published 2022-08-31

CVE-2022-2003 — Automationdirect D0-06dd1 Firmware

high

As of 2024-11-21, CVE-2022-2003 is a HIGH-severity vulnerability in Automationdirect D0-06dd1 Firmware, CVSS v3.1 7.7, EPSS 0.1% (32.6th percentile). No Threadlinqs-tracked threat campaign has been attributed to CVE-2022-2003 as of 2024-11-21; the identifier is re-checked against the Threadlinqs threat corpus on every daily ingest.

CVSS v3.1
7.7/10High
EPSS
0.1%Higher than 32.6% of scored CVEs
CISA KEV
NoNot in the KEV catalog
Tracked threats
0None linked yet
Priority
5.2/10Threadlinqs triage score
Published
Updated 2024-11-21
CVSS v3.1 7.7 (HIGH) · EPSS 0.1% (higher than 32.6% of all scored CVEs) · Priority 5.2/10 · Published 2022-08-31

Last updated:

What is CVE-2022-2003?

AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to 2.72; D0-06DD2 versions prior to 2.72; D0-06DR versions prior to 2.72; D0-06DA versions prior to 2.72; D0-06AR versions prior to 2.72; D0-06AA versions prior to 2.72; D0-06DD1-D versions prior to 2.72; D0-06DD2-D versions prior to 2.72; D0-06DR-D versions prior to 2.72;

The record classifies CVE-2022-2003 under weakness class CWE-319. Its CVSS v3 base vector states that the flaw requires local access to the host, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity. 18 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 1496 days ago.

Severity and exploitation probability

CVSS v3.1 base score
7.7 — HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS (FIRST)
0.1% probability of exploitation in the next 30 days, higher than 32.6% of all scored CVEs
CISA KEV
Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority
5.2/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published
2022-08-31, last modified 2024-11-21

Is CVE-2022-2003 being exploited?

It currently carries a trending score of 13 in the Threadlinqs vulnerability feed.

Affected products and versions

  • Automationdirect: D0-06dd1 Firmware, D0-06dd1, D0-06dd2 Firmware, D0-06dd2, D0-06dr Firmware, D0-06dr, D0-06da Firmware, D0-06da, D0-06ar Firmware, D0-06ar, D0-06aa Firmware, D0-06aa, D0-06dd1-d Firmware, D0-06dd1-d, D0-06dd2-d Firmware, D0-06dd2-d, D0-06dr-d Firmware, D0-06dr-d

How to fix CVE-2022-2003

The record marks a vendor fix as available for CVE-2022-2003. Patch reference: https://www.cisa.gov/news-events/ics-advisories/icsa-22-167-02. Vendor advisory: https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-02. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2022-2003

No threat campaign in the Threadlinqs corpus currently references CVE-2022-2003, in its CVE list or as an indicator. The linkage is recomputed from the live corpus on every daily ingest, so this section fills in as soon as a tracked campaign cites the identifier.

Sources

Seeded from nvd and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.