Security readout for executives and security teams
Plain-English summary
This flaw can let an unauthenticated network attacker read a previously successful PLC password and lock state from affected AutomationDirect CLICK C0-1x CPU modules. That password can then be reused to unlock the PLC. The business risk is loss of control over engineering protections in industrial equipment, not direct evidence of disruption or active exploitation.
Executive priority
Treat this as a high-priority industrial control exposure if affected PLCs are reachable beyond tightly controlled engineering networks. It directly weakens password-based PLC locking, but the provided evidence does not support claims of active exploitation.
Technical view
CVE-2021-32978 is a CWE-256 plaintext password storage issue in the CLICK PLC programming protocol. C0-1x CPUs with firmware before v3.00 may expose a previously entered successful password and lock state over the network. CVSS 3.1 is 7.5 with network attack vector, low complexity, no privileges, no user interaction, and high confidentiality impact.
Likely exposure
Exposure is most relevant where AutomationDirect CLICK C0-1x CPU programming interfaces are reachable from untrusted networks, shared plant networks, remote access paths, or compromised engineering workstations. Internet exposure would increase urgency, but the provided sources do not state how commonly these PLCs are exposed.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The vulnerability is still serious because the attack requires no authentication and can disclose a valid PLC password if one was previously entered successfully.
Researcher notes
Focus validation on asset identity, firmware version, and network reachability of the programming protocol. Do not assume impact beyond password and lock-state disclosure from the provided sources. Evidence is limited to CVE metadata and the CISA ICS advisory reference.
Mitigation direction
- Identify AutomationDirect CLICK C0-1x CPUs in production and lab environments.
- Prioritize devices running firmware earlier than v3.00 for vendor-directed remediation.
- Review the CISA and AutomationDirect advisory before changing PLC firmware.
- Restrict network access to PLC programming interfaces to authorized engineering systems.
- Segment affected control networks from corporate, guest, and internet-facing networks.
Validation and detection
- Confirm each CLICK C0-1x CPU model and firmware version from trusted asset records.
- Check whether any affected PLC programming interface is reachable from untrusted network segments.
- Verify remote access paths require strong authentication and are limited to authorized engineers.
- Confirm remediation status against the CISA advisory and vendor firmware guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-256: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-32978 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-166-02CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Plaintext Storage of a Password
Plaintext Storage of a Password represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.