Description
An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated users with low-level access permissions can exploit this vulnerability to read and modify PLC variables beyond their intended authorization level.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
AutomationDirect CLICK PLUS C0-0x CPU firmware
Default version status: unaffected
0 to < v3.71affected
AutomationDirect CLICK PLUS C0-1x CPU firmware
Default version status: unaffected
0 to < v3.71affected
AutomationDirect CLICK PLUS C2-x CPU firmware
Default version status: unaffected
0 to < v3.71affected