CVE-2025-59484

HighCVSS 8.3/10Last modified Oct 18, 2026

Description

The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software uses an insecure implementation of the RSA encryption algorithm.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
AutomationDirect	CLICK PLUS C0-0x CPU firmware	< v3.71
AutomationDirect	CLICK PLUS C0-1x CPU firmware	< v3.71
AutomationDirect	CLICK PLUS C2-x CPU firmware	< v3.71

References

Timeline

Published: Sep 23, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-594854.8Incorrect default permissions issue exists in Security Point (Windows) of MaLion prior to Ver.5.3.4. If this vulnerability is exploited, an CVE-2025-594878.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-594897.4Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code f CVE-2025-59498.8The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and inclu CVE-2025-594916.1Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields.CVE-2025-594947.8Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.CVE-2025-594974.7Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Linux allows an authorized attacker to deny service locally.CVE-2025-594998.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2025-59505.4The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and includ CVE-2025-595008.8Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network.CVE-2025-595014.8Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent netw CVE-2025-595027.5Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.