What’s Vulnerable › Vulnerabilities

CVE-2025-59484: AutomationDirect CLICK PLUS Use of a Broken or Risky Cryptographic Algorithm

• Severity: high (CVSS 8.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-23 · updated 2026-10-18
• Weakness: CWE-327

Description

The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software uses an insecure implementation of the RSA encryption algorithm.

Affected products

• AutomationDirect CLICK PLUS C0-0x CPU firmware: before v3.71 — fixed in v3.71
• AutomationDirect CLICK PLUS C0-1x CPU firmware: before v3.71 — fixed in v3.71
• AutomationDirect CLICK PLUS C2-x CPU firmware: before v3.71 — fixed in v3.71

How to fix

Upgrade to a fixed version: AutomationDirect CLICK PLUS C0-0x CPU firmware v3.71; AutomationDirect CLICK PLUS C0-1x CPU firmware v3.71; AutomationDirect CLICK PLUS C2-x CPU firmware v3.71. Check the vendor advisory for mitigations.

References

• https://www.automationdirect.com/support/software-downloads
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01

Get alerted when CVE-2025-59484 or the next vulnerability affects your stack