High severity · published Aug 31, 2022
CVE-2022-2485
AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
SIO- MB04ADS · AutomationDirect
before 8.4.3.0 · source: vendor
SI
SIO-MB04ADS · AutomationDirect
B/N 5714442222 · source: vendor
SI
SIO-MB04DAS · AutomationDirect
before 8.11.3.0; B/N 4714432222 · source: vendor
SI
SIO-MB04RTDS · AutomationDirect
before 8.3.4.0 · source: vendor
SI
SIO-MB04THMS · AutomationDirect
before 8.5.4.0; B/N 57141862221 · source: vendor
SI
SIO-MB08ADS-1 · AutomationDirect
before 8.6.3.0 · source: vendor
SI
SIO-MB08ADS-2 · AutomationDirect
before 8.7.3.0 · source: vendor
SI
SIO-MB08THMS · AutomationDirect
before 8.8.4.0 · source: vendor
SI
SIO-MB12CDR · AutomationDirect
before 8.0.4.0; batch number (B/N) 5714442222 · source: vendor
SI
SIO-MB16CDD2 · AutomationDirect
before 8.1.4.0 · source: vendor
SI
SIO-MB16ND3 · AutomationDirect
before 8.2.4.00 · source: vendor
SF
Sio-mb04ads Firmware · Automationdirect
before 8.4.3.0 · source: NVD