Read the docs
TI-2025-37028 Aliases CVE-2025-59484GHSA-p3m4-mwpv-24q7

AutomationDirect CLICK PLUS Use of a Broken or Risky Cryptographic Algorithm

Priority LOW 38CWE-327Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-327.

Summary

The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software uses an insecure implementation of the RSA encryption algorithm.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00124 2nd percentileScored 2026-11-07
Fix Fixed CLICK PLUS C0-0x CPU firmware (AutomationDirect): v3.71CLICK PLUS C0-1x CPU firmware (AutomationDirect): v3.71+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AutomationDirectCLICK PLUS C0-0x CPU firmwarebefore v3.71v3.71Patch availableCNA
AutomationDirectCLICK PLUS C0-1x CPU firmwarebefore v3.71v3.71Patch availableCNA
AutomationDirectCLICK PLUS C2-x CPU firmwarebefore v3.71v3.71Patch availableCNA
  • CLICK PLUS C0-0x CPU firmware VendorAutomationDirect Affected before v3.71 Fixed in v3.71 Patch available CNA
  • CLICK PLUS C0-1x CPU firmware VendorAutomationDirect Affected before v3.71 Fixed in v3.71 Patch available CNA
  • CLICK PLUS C2-x CPU firmware VendorAutomationDirect Affected before v3.71 Fixed in v3.71 Patch available CNA

Remediation

  • Fix · CNA CLICK PLUS C0-0x CPU firmware (AutomationDirect) Fixed in v3.71
  • Fix · CNA CLICK PLUS C0-1x CPU firmware (AutomationDirect) Fixed in v3.71
  • Fix · CNA CLICK PLUS C2-x CPU firmware (AutomationDirect) Fixed in v3.71

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    AutomationDirect CLICK PLUS C0-0x CPU firmware, CLICK PLUS C0-1x CPU firmware, CLICK PLUS C2-x CPU firmware v3.71

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2025-34759 AutomationDirect CLICK PLUS Predictable Seed in Pseudo-Random Number GeneratorPriority LOW 39
    • TI-2025-36230 AutomationDirect CLICK PLUS Improper Resource Shutdown or ReleasePriority LOW 36
    • TI-2025-35912 AutomationDirect CLICK PLUS Use of Hard-coded Cryptographic KeyPriority LOW 36
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59484
  2. 2026-10-03 Alias added: GHSA-p3m4-mwpv-24q7

References

Other 2

  • TI-2024-14467 A leftover debug code vulnerability exists in the Telnet Diagnostic Interface… CVSS 3.1CRITICAL 9.8
  • TI-2024-14780 Improper access control in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.1
  • TI-2025-24868 AutomationDirect MB-Gateway Missing Authentication for Critical Function CVSS 4.0CRITICAL 10.0
  • TI-2024-16461 Stack-based buffer overflow in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.8
  • TI-2024-16460 Stack-based buffer overflow in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.8
  • TI-2021-12594 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel CVSS 3.1CRITICAL 9.8
See all 66 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences