CVE-2025-55038: falha de alta gravidade em AutomationDirect CLICK PLUS C0-0x CPU firmware
AutomationDirect CLICK PLUS Missing Authorization
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.6epss 0.3%
An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated users with low-level access permissions can exploit this vulnerability to read and modify PLC variables beyond their intended authorization level.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
AutomationDirect · CLICK PLUS C0-0x CPU firmwareAutomationDirect · CLICK PLUS C0-1x CPU firmwareAutomationDirect · CLICK PLUS C2-x CPU firmwareCVEs relacionadas — AutomationDirect CLICK PLUS C0-0x CPU firmware
No mesmo produto, das mais perigosas para as menos.
CVE-2025-58473HIGHAutomationDirect CLICK PLUS Improper Resource Shutdown or ReleaseEPSS 0.4%CVE-2025-57882HIGHAutomationDirect CLICK PLUS Improper Resource Shutdown or ReleaseEPSS 0.3%CVE-2025-55069HIGHAutomationDirect CLICK PLUS Predictable Seed in Pseudo-Random Number GeneratorEPSS 0.3%CVE-2025-58069MEDIUMAutomationDirect CLICK PLUS Use of Hard-coded Cryptographic KeyEPSS 0.3%CVE-2025-59484HIGHAutomationDirect CLICK PLUS Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.1%CVE-2025-54855MEDIUMAutomationDirect CLICK PLUS Cleartext Storage of Sensitive InformationEPSS 0.1%