CVE-2025-55038: Automationdirect Click Plus c0-0x CPU Firmware

Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.

An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated users with low-level access permissions can exploit this vulnerability to read and modify PLC variables beyond their intended authorization level.

Affected products

• Automationdirect Click Plus c0-0x CPU Firmware: before v3.71 (fixed in v3.71)
• Automationdirect Click Plus c0-1x CPU Firmware: before v3.71 (fixed in v3.71)
• Automationdirect Click Plus c2-X CPU Firmware: before v3.71 (fixed in v3.71)

Published 2025-09-23. Last modified 2026-06-17.