Incident Score: Analysis & Impact (AUT3621036112625)

In this Rankiteo incident briefing, we review the AutomationDirect breach identified under incident ID AUT3621036112625.

The analysis begins with a detailed overview of AutomationDirect's information like the linkedin page: https://www.linkedin.com/company/automationdirect, the number of followers: 20036, the industry type: Automation Machinery Manufacturing and the number of employees: 313 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 747 and after the incident was 752 with a difference of 5 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on AutomationDirect and their customers.

AutomationDirect recently reported "Critical Authentication Vulnerability in AutomationDirect MB-Gateway Devices (CVE-2025-36535)", a noteworthy cybersecurity incident.

Industrial automation firm AutomationDirect's MB-Gateway devices, used in critical infrastructure globally, are affected by a maximum-severity missing authentication vulnerability (CVE-2025-36535).

The disruption is felt across the environment, affecting AutomationDirect MB-Gateway Devices (100+ internet-exposed instances), and exposing Internal IPs, Firmware Versions and Modbus Configuration.

In response, moved swiftly to contain the threat with measures like Replacement of vulnerable MB-Gateway devices with EKI-1221-CE gateway, and stakeholders are being briefed through Public disclosure via SecurityWeek and CISA advisory.

The case underscores how Disclosed (vulnerability confirmed; no active exploitation reported), teams are taking away lessons such as Hardware limitations can render vulnerabilities unpatchable, necessitating full device replacement. Critical infrastructure devices require rigorous authentication mechanisms to prevent remote exploitation, and recommending next steps like Replace vulnerable MB-Gateway devices with EKI-1221-CE immediately, Isolate or remove internet-exposed industrial control systems and Implement network segmentation for critical infrastructure devices, with advisories going out to stakeholders covering CISA alert for critical infrastructure operators.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.