Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2025-59484 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software uses an insecure implementation of the RSA encryption algorithm.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:8.3 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.automationdirect.com/support/software-downloads	[email protected]	Vendor
https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01	[email protected]	AdvisoryBundleRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-327	Use of a Broken or Risky Cryptographic Algorithm	[email protected]

Affected Products

Product	Versions
AutomationDirect CLICK PLUS	< 3.71
CPE cpe:2.3:o:automationdirect:click_plc_firmware:::::::: Remediation Upgrade: 3.80moderate efforthttps://www.automationdirect.com/support/software-downloads Mitigation:low effort Disconnect the CLICK PLUS PLC from external networks (e.g., the internet or corporate LAN) to reduce exposure. Mitigation:low effort Use only trusted, dedicated internal networks or air-gapped systems for device communication. Mitigation:low effort Restrict both physical and logical access to authorized personnel only. Mitigation:low effort Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software. Mitigation:low effort Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts. Mitigation:low effort Enable and regularly review system logs to detect suspicious or unauthorized activity. Mitigation:low effort Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident. Mitigation:low effort Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.

Product

Versions

AutomationDirect CLICK PLUS

< 3.71

CPE

cpe:2.3:o:automationdirect:click_plc_firmware:*:*:*:*:*:*:*:*

Remediation

Upgrade: 3.80moderate efforthttps://www.automationdirect.com/support/software-downloads
Mitigation:low effort
Disconnect the CLICK PLUS PLC from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation:low effort
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation:low effort
Restrict both physical and logical access to authorized personnel only.
Mitigation:low effort
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation:low effort
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation:low effort
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation:low effort
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
Mitigation:low effort
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.

Change History

3 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Sep 23, 2025	New CVE Received	[email protected]