CVE-2021-32986

Q: What is the severity of CVE-2021-32986?

CVE-2021-32986 has a CVSS score of 9.8 (CRITICAL). This vulnerability in Automation Direct CLICK PLC CPU Modules allows unauthorized programming access after an authorized session is interrupted. The PLC remains unlocked indefinitely until power-cycled, enabling attackers to modify industrial control logic without authentication. This affects organizations using these PLCs in operational technology environments.

9.8 CRITICAL

Authentication Bypass

📋 TL;DR

This vulnerability in Automation Direct CLICK PLC CPU Modules allows unauthorized programming access after an authorized session is interrupted. The PLC remains unlocked indefinitely until power-cycled, enabling attackers to modify industrial control logic without authentication. This affects organizations using these PLCs in operational technology environments.

💻 Affected Systems

Products:

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs

Versions: Firmware prior to v3.00

Operating Systems: Not applicable - PLC firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Affects all C0-1x CPUs with vulnerable firmware when programming software is used.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain persistent unauthorized access to modify PLC programming, potentially causing physical damage, production shutdowns, or safety incidents in industrial environments.

🟠

Likely Case

Unauthorized personnel or malware could modify PLC logic to disrupt operations, cause equipment damage, or create safety hazards without detection.

🟢

If Mitigated

With proper network segmentation and monitoring, impact is limited to unauthorized programming changes within isolated control networks.

🌐 Internet-Facing: LOW

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires initial authorized access followed by interruption of programming session. No public exploit code known.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Firmware v3.00 or later

Vendor Advisory: https://www.automationdirect.com/support/security-advisories

Restart Required: Yes

Instructions:

1. Download firmware v3.00+ from Automation Direct website. 2. Backup current PLC program. 3. Connect programming software. 4. Upload new firmware. 5. Restart PLC. 6. Restore program.

🔧 Temporary Workarounds

Power cycle after programming sessions

all

Manually power cycle PLC after every programming session to force re-lock

Network segmentation

all

Isolate PLC programming network from general IT network

🧯 If You Can't Patch

Implement strict physical access controls to PLC programming ports
Monitor for unauthorized programming connections and implement alerting

🔍 How to Verify

Check if Vulnerable:

Check firmware version in programming software: If version is below 3.00, system is vulnerable.

Check Version:

Use CLICK Programming Software to read PLC firmware version

Verify Fix Applied:

After updating to v3.00+, test by interrupting programming session and attempting unauthorized connection.

📡 Detection & Monitoring

Log Indicators:

Multiple programming connections from unauthorized IPs
Programming sessions without proper authentication logs

Network Indicators:

Unexpected programming protocol traffic (C-More/Ethernet)
Programming connections from unauthorized network segments

SIEM Query:

source="plc_logs" AND (event_type="programming_session" AND auth_status="failed") OR (event_type="programming_session" AND src_ip NOT IN allowed_ips)

📊 Metadata

CVE ID: CVE-2021-32986

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-288

Published: April 4, 2022

Last Updated: November 21, 2024

🔗 References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02 Third Party Advisory,US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02 Third Party Advisory,US Government Resource

📋 TL;DR

💻 Affected Systems

📦 What is this software?

C0 10are D Firmware by Automationdirect

C0 10dd1e D Firmware by Automationdirect

C0 10dd2e D Firmware by Automationdirect

C0 10dre D Firmware by Automationdirect

C0 11are D Firmware by Automationdirect

C0 11dd1e D Firmware by Automationdirect

C0 11dd2e D Firmware by Automationdirect

C0 11dre D Firmware by Automationdirect

C0 12are 1 D Firmware by Automationdirect

C0 12are 2 D Firmware by Automationdirect

C0 12are D Firmware by Automationdirect

C0 12dd1e 1 D Firmware by Automationdirect

C0 12dd1e 2 D Firmware by Automationdirect

C0 12dd1e D Firmware by Automationdirect

C0 12dd2e 1 D Firmware by Automationdirect

C0 12dd2e 2 D Firmware by Automationdirect

C0 12dd2e D Firmware by Automationdirect

C0 12dre 1 D Firmware by Automationdirect

C0 12dre 2 D Firmware by Automationdirect

C0 12dre D Firmware by Automationdirect