#VU97239 Session Fixation in DirectLogic H2-DM1E - CVE-2024-45368

Vulnerability identifier: #VU97239

Vulnerability risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-45368

CWE-ID: CWE-384

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
DirectLogic H2-DM1E
Hardware solutions / Firmware

Vendor: AutomationDirect

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the session fixation issue within the authentication protocol. A remote attacker on the local network can gain unauthorized access to the application.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

DirectLogic H2-DM1E: 2.8.0

---

External links
https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-17

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.