CVE-2025-58069 Overview
CVE-2025-58069 identifies a hard-coded cryptographic key vulnerability in firmware version 3.60 of the AutomationDirect Click Plus programmable logic controller (PLC). The firmware embeds a static Advanced Encryption Standard (AES) key used to protect the initial messages of a new KOPS session. Attackers with network access to the device can extract or reuse this key to decrypt session initialization traffic. The weakness is tracked under CWE-321: Use of Hard-coded Cryptographic Key and is documented in CISA ICS Advisory ICSA-25-266-01.
Critical Impact
A network-based attacker can compromise the confidentiality of KOPS session initialization traffic on affected Click Plus PLCs because the AES key is embedded in firmware.
Affected Products
- AutomationDirect Click Plus PLC firmware version 3.60
- KOPS session initialization on affected Click Plus devices
- Industrial Control System (ICS) environments deploying the affected firmware
Discovery Timeline
- 2025-09-23 - CVE-2025-58069 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Record last modified in NVD
Technical Details for CVE-2025-58069
Vulnerability Analysis
The Click Plus PLC firmware uses AES symmetric encryption to protect the initial messages exchanged when a new KOPS session is established. Instead of deriving the key from a per-session secret or negotiated material, the firmware relies on an AES key that is compiled into the binary and shared across all deployed devices running firmware 3.60. Any party able to obtain the firmware image can recover the key through static analysis or memory extraction. Once recovered, the key applies to every affected device globally, not just a single unit.
The vulnerability affects the confidentiality of session bootstrap traffic. According to the CVSS 4.0 vector, the attack targets confidentiality without impacting integrity or availability of the vulnerable component. Exploitation requires network reachability to the PLC but no authentication and no user interaction.
Root Cause
The root cause is a design decision to embed a static AES key in firmware rather than negotiating session keys dynamically or provisioning device-unique secrets during manufacturing. This pattern falls under [CWE-321], where confidentiality guarantees collapse once the shared secret is extracted from any single firmware image.
Attack Vector
An attacker on the same network segment as the PLC captures KOPS session initialization traffic through passive sniffing or an active on-path position. Using the AES key recovered from firmware analysis, the attacker decrypts the initial protocol messages. This exposes information carried during session bootstrap, such as identifiers or parameters that could inform subsequent attacks against the control environment.
No verified exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability score is 0.244%.
Detection Methods for CVE-2025-58069
Indicators of Compromise
- Unexpected KOPS protocol sessions originating from unauthorized hosts on the operational technology (OT) network
- Passive traffic capture activity, such as promiscuous-mode interfaces, on network segments carrying PLC communications
- Configuration changes on Click Plus PLCs that do not correlate with authorized engineering workstation activity
Detection Strategies
- Inventory Click Plus PLCs and verify the running firmware version against 3.60 to identify vulnerable devices
- Baseline expected KOPS client endpoints and alert when new source addresses initiate sessions with PLCs
- Deploy ICS-aware network monitoring to inspect KOPS session establishment patterns and flag anomalies
Monitoring Recommendations
- Forward PLC network telemetry and firewall logs to a centralized analytics platform for correlation across the OT boundary
- Monitor for lateral movement from IT networks into OT segments where Click Plus PLCs are reachable
- Track firmware version drift and unauthorized configuration writes as leading indicators of tampering
How to Mitigate CVE-2025-58069
Immediate Actions Required
- Apply the vendor-provided firmware update available through AutomationDirect Software Downloads once released for your device
- Restrict network access to Click Plus PLCs so that only authorized engineering workstations can reach the KOPS service
- Segment OT networks from corporate IT networks and enforce access through a hardened jump host or firewall
Patch Information
AutomationDirect publishes updated firmware through its support portal. Consult CISA ICS Advisory ICSA-25-266-01 for the specific fixed firmware version and remediation guidance associated with CVE-2025-58069.
Workarounds
- Place affected PLCs behind an industrial firewall configured to allow KOPS traffic only from a defined allowlist of engineering hosts
- Route management traffic through a VPN or encrypted tunnel to prevent passive interception on shared network segments
- Disable remote programming interfaces when not actively required for maintenance windows
# Configuration example: restrict KOPS access to engineering workstations
iptables -A FORWARD -s 10.10.20.15/32 -d 10.20.30.0/24 -p tcp --dport 25425 -j ACCEPT
iptables -A FORWARD -d 10.20.30.0/24 -p tcp --dport 25425 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
