CVE-2025-55038

Summary

An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated users with low-level access permissions can exploit this vulnerability to read and modify PLC variables beyond their intended authorization level.

Affected Software

VendorProductVersion RangeStatus
AutomationDirectCLICK PLUS C0-0x CPU firmware0 < v3.71affected
AutomationDirectCLICK PLUS C0-1x CPU firmware0 < v3.71affected
AutomationDirectCLICK PLUS C2-x CPU firmware0 < v3.71affected

Weaknesses

  • CWE-862: CWE-862 Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References