CVE-2025-25051

AutomationDirect CLICK Programmable Logic Controller Plaintext Storage of a Password

State: Published
Severity: 6.1 Medium
Published: Jan 22, 2026
Updated: Jan 23, 2026
Reserved: Feb 5, 2025

Description

An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N	icscert

Weaknesses

CWE-256

Affected Products

Product	Versions
CLICK Programmable Logic ControllerAutomationDirect	C0-0xAffected C0-1xAffected C2-xAffected V3.90Not affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-02
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-022-02.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.