CVE-2022-2485

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
AutomationDirect	SIO-MB04RTDS	>= unspecified, < 8.3.4.0
AutomationDirect	SIO- MB04ADS	>= unspecified, < 8.4.3.0
AutomationDirect	SIO-MB04THMS	>= unspecified, < 8.5.4.0
AutomationDirect	SIO-MB08ADS-1	>= unspecified, < 8.6.3.0
AutomationDirect	SIO-MB08ADS-2	>= unspecified, < 8.7.3.0
AutomationDirect	SIO-MB08THMS	>= unspecified, < 8.8.4.0
AutomationDirect	SIO-MB04DAS	>= unspecified, < 8.11.3.0
AutomationDirect	SIO-MB12CDR	>= unspecified, < 8.0.4.0
AutomationDirect	SIO-MB16CDD2	>= unspecified, < 8.1.4.0
AutomationDirect	SIO-MB16ND3	>= unspecified, < 8.2.4.00
AutomationDirect	SIO-MB12CDR	batch number (B/N) 5714442222
AutomationDirect	SIO-MB04ADS	B/N 5714442222
AutomationDirect	SIO-MB04THMS	B/N 57141862221
AutomationDirect	SIO-MB04DAS	B/N 4714432222

References

https://cdn.automationdirect.com/static/firmware/product_advisory/PA-COM-006.pdfPatch, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-05Patch, Third Party Advisory, US Government Resource
https://cdn.automationdirect.com/static/firmware/product_advisory/PA-COM-006.pdfPatch, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-05Patch, Third Party Advisory, US Government Resource

Timeline

Published: Aug 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-248504.3Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has acce CVE-2022-248514.8LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an e CVE-2022-248535.3Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as par CVE-2022-248548.8Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which a CVE-2022-248555.4Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development CVE-2022-248567.5FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request for CVE-2022-248578.8django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular CVE-2022-248586.1next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 CVE-2022-248595.5PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions pr CVE-2022-24869.8A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-b CVE-2022-248609.8Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key CVE-2022-248618.8Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code execution vulnerability.