CVE-2025-57882 Overview
CVE-2025-57882 is an improper resource shutdown or release vulnerability [CWE-404] affecting the AutomationDirect Click Plus C2-03CPU-2 programmable logic controller (PLC) running firmware version 3.60. An unauthenticated remote attacker can exhaust all available device sessions in the Remote PLC application, producing a denial-of-service condition. The flaw impacts availability of industrial control system (ICS) operations that rely on the Remote PLC service for engineering access and runtime communication. CISA published ICS advisory ICSA-25-266-01 covering this issue.
Critical Impact
Unauthenticated network attackers can render the Click Plus C2-03CPU-2 Remote PLC application unreachable by exhausting its session pool, disrupting industrial process control and engineering connectivity.
Affected Products
- AutomationDirect Click Plus C2-03CPU-2
- Firmware version 3.60
- Remote PLC application component
Discovery Timeline
- 2025-09-23 - CVE-2025-57882 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-57882
Vulnerability Analysis
The vulnerability resides in the Remote PLC application on the Click Plus C2-03CPU-2 controller. The service accepts new client sessions but fails to release session resources correctly under adversarial conditions. An attacker can open sessions repeatedly until the internal session table is fully consumed. Once exhausted, legitimate engineers and supervisory systems can no longer establish connections to the PLC. The issue maps to [CWE-404] Improper Resource Shutdown or Release and produces a network-reachable denial-of-service condition against the availability of the device.
Root Cause
The Remote PLC service does not reliably reclaim session slots after connections terminate abnormally or remain idle. Because no authentication is required to initiate a session, an attacker with network access to the PLC management interface can drive the session table to its upper bound. The controller then rejects further connections until it is restarted or sessions are manually cleared.
Attack Vector
Exploitation requires network reachability to the Click Plus C2-03CPU-2 Remote PLC service. The attacker repeatedly initiates Remote PLC sessions without properly closing them, consuming every available session slot. No credentials, user interaction, or prior foothold are required. The vulnerability does not permit code execution or data modification, but it disrupts operational technology (OT) availability, which is often the primary security objective in ICS environments.
No verified public exploit code is available. Refer to the CISA ICS Advisory ICSA-25-266-01 for authoritative technical details.
Detection Methods for CVE-2025-57882
Indicators of Compromise
- Sudden inability of engineering workstations or SCADA clients to connect to the Click Plus C2-03CPU-2 Remote PLC service.
- Elevated volume of inbound TCP connections to the PLC management port from a single or small set of source addresses.
- Repeated short-lived or half-open sessions to the Remote PLC application without normal protocol completion.
Detection Strategies
- Baseline the number of concurrent Remote PLC sessions per device and alert on unusual growth toward the session limit.
- Monitor OT network segments with passive protocol analyzers for anomalous session establishment patterns targeting AutomationDirect controllers.
- Correlate PLC unreachability events with connection floods from non-engineering hosts using SIEM rules.
Monitoring Recommendations
- Ingest firewall and switch flow logs adjacent to the PLC into a centralized analytics platform for connection-rate analysis.
- Enable syslog or SNMP polling from the Click Plus controller where available to track session counts and availability.
- Alert on any connection to the Remote PLC service originating outside an approved engineering allowlist.
How to Mitigate CVE-2025-57882
Immediate Actions Required
- Restrict network access to the Click Plus C2-03CPU-2 Remote PLC service to authorized engineering hosts using firewall rules or ACLs.
- Place the affected PLCs behind a segmented OT network with no direct exposure to corporate or internet-facing networks.
- Apply the vendor-provided firmware update once available from AutomationDirect Software Downloads.
Patch Information
AutomationDirect distributes updated firmware and programming software through the AutomationDirect Software Downloads portal. Review CISA ICS Advisory ICSA-25-266-01 for the specific fixed firmware version and remediation guidance for the Click Plus C2-03CPU-2 running firmware 3.60.
Workarounds
- Implement strict network segmentation and jump-host access for all engineering connectivity to Click Plus PLCs.
- Deploy an OT-aware firewall or data diode to block unauthorized inbound sessions to the Remote PLC service.
- Establish an operational runbook to power-cycle or restart affected controllers when session exhaustion is detected, minimizing process downtime.
- Disable the Remote PLC application on devices that do not require remote engineering access.
# Configuration example: sample firewall rule restricting Remote PLC access
# Replace 10.20.30.0/24 with the authorized engineering subnet
# Replace <PLC_IP> with the Click Plus C2-03CPU-2 address
iptables -A FORWARD -s 10.20.30.0/24 -d <PLC_IP> -p tcp --dport 25425 -j ACCEPT
iptables -A FORWARD -d <PLC_IP> -p tcp --dport 25425 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
