CVE-2024-43099 AutomationDirect CVE debrief

Who should care

Organizations operating AutomationDirect DirectLogic H2-DM1E PLCs in manufacturing, process control, or other industrial environments. OT security teams responsible for legacy PLC infrastructure. Asset owners with end-of-life industrial equipment requiring risk-based mitigation strategies. Compliance officers managing NERC CIP or IEC 62443 security programs with unsupported control system components.

Technical summary

The DirectLogic H2-DM1E uses a session key to maintain authenticated sessions between host PC and PLC. The vulnerability allows an attacker who captures this session key to inject arbitrary traffic into an active session. Successful exploitation requires the attacker to also spoof the IP address and MAC address of the legitimate host. This is an application-layer control mechanism failure in session management. The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates adjacent network attack vector with no privileges required, yielding high impacts to confidentiality, integrity, and availability.

Defensive priority

HIGH

Recommended defensive actions

• Upgrade to the BRX platform, which is actively maintained within AutomationDirect's secure development lifecycle and designed to current security standards
• Implement network segmentation and air gapping to isolate H2-DM1E systems from broader network infrastructure
• Deploy StrideLinx secure VPN platform to place affected systems behind encrypted tunnel access
• Conduct asset inventory to identify all H2-DM1E deployments in operational technology environments
• Review network architecture for H2-DM1E systems to ensure they are not exposed to untrusted networks
• Establish monitoring for anomalous session behavior or unexpected traffic injection attempts on H2-DM1E communications
• Contact AutomationDirect for migration planning assistance and additional security guidance

Evidence notes

Session hijacking requires attacker to capture session key and spoof IP/MAC addresses of legitimate host. Attack vector is adjacent network (AV:A) with low attack complexity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.