What’s Vulnerable › Vulnerabilities
CVE-2024-43099: AutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replay
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-09-13 · updated 2026-06-17
- Weakness: CWE-294
Description
The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into an ongoing authenticated session. To successfully achieve this, the attacker also needs to spoof both the IP address and MAC address of the originating host which is typical of a session-based attack.
Affected products
- AutomationDirect H2-Dm1E Firmware: through 2.8.0
References
Get alerted when CVE-2024-43099 or the next vulnerability affects your stack