What’s Vulnerable › Vulnerabilities

CVE-2025-36535: AutomationDirect MB-Gateway Missing Authentication for Critical Function

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-21 · updated 2026-06-17
• Weakness: CWE-306

Description

The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational disruption, or arbitrary code execution depending on the environment and exposed functionality.

Affected products

• AutomationDirect MB-Gateway: all versions

References

• https://www.automationdirect.com/adc/shopping/catalog/communications/protocol_gateways/modbus_gateways/eki-1221-ce
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-09

Get alerted when CVE-2025-36535 or the next vulnerability affects your stack