{"id":"CVE-2025-55038","state":"PUBLISHED","title":"AutomationDirect CLICK PLUS Missing Authorization","description":"An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated users with low-level access permissions can exploit this vulnerability to read and modify PLC variables beyond their intended authorization level.","publishedAt":"2025-09-23T22:24:28.676Z","updatedAt":"2025-09-24T14:07:38.232Z","severity":{"score":7.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["AutomationDirect CLICK PLUS C0-0x CPU firmware","AutomationDirect CLICK PLUS C0-1x CPU firmware","AutomationDirect CLICK PLUS C2-x CPU firmware"],"affected":[{"vendor":"AutomationDirect","product":"CLICK PLUS C0-0x CPU firmware","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v3.71","versionType":"custom"}]},{"vendor":"AutomationDirect","product":"CLICK PLUS C0-1x CPU firmware","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v3.71","versionType":"custom"}]},{"vendor":"AutomationDirect","product":"CLICK PLUS C2-x CPU firmware","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v3.71","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01","https://www.automationdirect.com/support/software-downloads"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/55xxx/CVE-2025-55038.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-55038","state":"PUBLISHED","datePublished":"2025-09-23T22:24:28.676Z","dateUpdated":"2025-09-24T14:07:38.232Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2025-09-16T20:09:26.660Z"},"containers":{"cna":{"title":"AutomationDirect CLICK PLUS Missing Authorization","descriptions":[{"lang":"en","value":"An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated users with low-level access permissions can exploit this vulnerability to read and modify PLC variables beyond their intended authorization level."}],"affected":[{"vendor":"AutomationDirect","product":"CLICK PLUS C0-0x CPU firmware","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v3.71","versionType":"custom"}]},{"vendor":"AutomationDirect","product":"CLICK PLUS C0-1x CPU firmware","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v3.71","versionType":"custom"}]},{"vendor":"AutomationDirect","product":"CLICK PLUS C2-x CPU firmware","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v3.71","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01"},{"url":"https://www.automationdirect.com/support/software-downloads"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.6,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-09-23T22:24:28.676Z"},"credits":[{"lang":"en","type":"finder","value":"Luca Borzacchiello and Diego Zaffaroni of Nozomi Networks reported these vulnerabilities to Automation Direct."}],"datePublic":"2025-09-23T16:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

AutomationDirect recommends that users update CLICK PLUS and firmware to V3.80.

If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed:

\n\n
"}],"value":"AutomationDirect recommends that users update CLICK PLUS and firmware to V3.80. https://www.automationdirect.com/support/software-downloads \n\nIf the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed:\n\n * Network Isolation – Disconnect the CLICK PLUS PLC from external networks (e.g., the internet or corporate LAN) to reduce exposure.\n * Secure Communications – Use only trusted, dedicated internal networks or air-gapped systems for device communication.\n * Access Control – Restrict both physical and logical access to authorized personnel only.\n * Application Whitelisting – Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.\n * Endpoint Protection – Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.\n * Logging & Monitoring – Enable and regularly review system logs to detect suspicious or unauthorized activity.\n * Backup & Recovery – Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.\n * Ongoing Risk Assessment – Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly."}],"source":{"advisory":"ICSA-25-266-01","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-24T14:06:10.499891Z","id":"CVE-2025-55038","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-24T14:07:38.232Z"}}]}}}