High severity · published Sep 23, 2025
CVE-2025-59484
AutomationDirect CLICK PLUS Use of a Broken or Risky Cryptographic Algorithm
8.3
CVSS
0.1%
EPSS
No
On KEV
Description
The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software uses an insecure implementation of the RSA encryption algorithm.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CLICK PLUS C0-0x CPU firmware · AutomationDirect
before v3.71 · source: vendor
CP
CLICK PLUS C0-1x CPU firmware · AutomationDirect
before v3.71 · source: vendor
CP
CLICK PLUS C2-x CPU firmware · AutomationDirect
before v3.71 · source: vendor
Affected product
CP
CLICK PLUS C0-0x CPU firmware
AutomationDirect
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59484
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59484
www.automationdirect.com
https://www.automationdirect.com/support/software-downloads
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01
More from CLICK PLUS C0-0x CPU firmware
8.3
CVE-2025-55069
AutomationDirect CLICK PLUS Predictable Seed in Pseudo-Random Number Generator
6.8
CVE-2025-55038
AutomationDirect CLICK PLUS Missing Authorization
5.9
CVE-2025-57882
AutomationDirect CLICK PLUS Improper Resource Shutdown or Release
5.9
CVE-2025-58473
AutomationDirect CLICK PLUS Improper Resource Shutdown or Release
5.3
CVE-2025-58069
AutomationDirect CLICK PLUS Use of Hard-coded Cryptographic Key