Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2025-58069

AutomationDirect CLICK PLUS Use of Hard-coded Cryptographic Key

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software contains a hard-coded AES key used to protect the initial messages of a new KOPS session.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AutomationDirect CLICK PLUS C0-0x CPU firmware

Default version status: unaffected

  • 0 to < v3.71affected

AutomationDirect CLICK PLUS C0-1x CPU firmware

Default version status: unaffected

  • 0 to < v3.71affected

AutomationDirect CLICK PLUS C2-x CPU firmware

Default version status: unaffected

  • 0 to < v3.71affected

References