CVE-2022-2485: AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-31 · updated 2026-06-17
Weakness: CWE-319

Description

Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets.

Affected products

AutomationDirect Sio-Mb04Ads Firmware: before 8.4.3.0 — fixed in 8.4.3.0
AutomationDirect Sio-Mb04Das Firmware: before 8.11.3.0 — fixed in 8.11.3.0
AutomationDirect Sio-Mb04Rtds Firmware: before 8.3.4.0 — fixed in 8.3.4.0
AutomationDirect Sio-Mb04Thms Firmware: before 8.5.4.0 — fixed in 8.5.4.0
AutomationDirect Sio-Mb08Ads-1 Firmware: before 8.6.3.0 — fixed in 8.6.3.0
AutomationDirect Sio-Mb08Ads-2 Firmware: before 8.7.3.0 — fixed in 8.7.3.0
AutomationDirect Sio-Mb08Thms Firmware: before 8.8.4.0 — fixed in 8.8.4.0
AutomationDirect Sio-Mb12Cdr Firmware: before 8.0.4.0 — fixed in 8.0.4.0
AutomationDirect Sio-Mb16Cdd2 Firmware: before 8.1.4.0 — fixed in 8.1.4.0
AutomationDirect Sio-Mb16Nd3 Firmware: before 8.2.4.0 — fixed in 8.2.4.0

How to fix

Upgrade to a fixed version: AutomationDirect Sio-Mb04Ads Firmware 8.4.3.0; AutomationDirect Sio-Mb04Das Firmware 8.11.3.0; AutomationDirect Sio-Mb04Rtds Firmware 8.3.4.0; AutomationDirect Sio-Mb04Thms Firmware 8.5.4.0; AutomationDirect Sio-Mb08Ads-1 Firmware 8.6.3.0; AutomationDirect Sio-Mb08Ads-2 Firmware 8.7.3.0; AutomationDirect Sio-Mb08Thms Firmware 8.8.4.0; AutomationDirect Sio-Mb12Cdr Firmware 8.0.4.0; AutomationDirect Sio-Mb16Cdd2 Firmware 8.1.4.0; AutomationDirect Sio-Mb16Nd3 Firmware 8.2.4.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-2485 or the next vulnerability affects your stack