Automationdirect Click Plus c2-X CPU Firmware vulnerabilities

7 CVEs affecting Automationdirect Click Plus c2-X CPU Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-58473, published 2025-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-58473, published 2025-09-23. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability allows an unauthenticated attacker to…
CVE-2025-57882, published 2025-09-23. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability allows an unauthenticated attacker to…
CVE-2025-55069, published 2025-09-23. High severity, CVSS 8.3. EPSS: 0.3% chance of exploitation in the next 30 days. A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software…
CVE-2025-58069, published 2025-09-23. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software contains a hard-coded AES key used to…
CVE-2025-55038, published 2025-09-23. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated…
CVE-2025-59484, published 2025-09-23. High severity, CVSS 8.3. EPSS: 0.1% chance of exploitation in the next 30 days. The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software uses an insecure…
CVE-2025-54855, published 2025-09-23. Medium severity, CVSS 4.2. EPSS: 0.1% chance of exploitation in the next 30 days. Cleartext storage of sensitive information was discovered in Click Programming Software version v3.60. The vulnerability can be exploited by a local user with access to the file system, while an…