CVE-2021-32980

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Apr 4, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-329817.2AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or dCVE-2021-329827.5Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and projecCVE-2021-329839.8A Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and pCVE-2021-329849.8All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation DirCVE-2021-329857.2AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid.CVE-2021-329869.8After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked stateCVE-2021-329877.5Null pointer dereference in SuiteLink server while processing command 0x0bCVE-2021-329889.8FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitCVE-2021-329896.1When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which mayCVE-2021-329909.8FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrCVE-2021-329914.3Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a useCVE-2021-329929.8FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may al
CVE-2021-32980: Critical severity, CVSS 9.8 | Vulnix