What’s Vulnerable › Vulnerabilities
CVE-2024-45368: AutomationDirect DirectLogic H2-DM1E Session Fixation
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-09-13 · updated 2026-06-17
- Weakness: CWE-384
Description
The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed anomaly in the H2-DM1E PLC's protocol execution, namely its acceptance of multiple distinct packets as valid authentication responses. This behavior deviates from standard security practices where a single, specific response or encoding pattern is expected for successful authentication.
Affected products
- AutomationDirect H2-Dm1E Firmware: through 2.8.0
References
Get alerted when CVE-2024-45368 or the next vulnerability affects your stack