CVE-2025-58473: Click Plus C2-03CPU-2 DoS Vulnerability

CVE-2025-58473 Overview

CVE-2025-58473 is an improper resource shutdown or release vulnerability [CWE-404] affecting the AutomationDirect Click Plus C2-03CPU-2 programmable logic controller (PLC) running firmware version 3.60. The flaw allows an unauthenticated remote attacker to exhaust all available device sessions of the Click Programming Software, producing a denial-of-service condition. The device becomes unable to accept new engineering connections until sessions are released. CISA published advisory ICSA-25-266-01 describing the issue in industrial control system environments.

Critical Impact
An unauthenticated network attacker can exhaust device session resources, blocking legitimate engineering access to the Click Plus PLC and disrupting industrial control operations.

Affected Products

AutomationDirect Click Plus C2-03CPU-2 PLC
Firmware version 3.60
Devices reachable by the Click Programming Software over the network

Discovery Timeline

2025-09-23 - CVE-2025-58473 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58473

Vulnerability Analysis

The vulnerability resides in the session handling logic of the Click Plus C2-03CPU-2 device firmware. The device exposes a finite pool of sessions used by the Click Programming Software to connect, program, and monitor the PLC. Because sessions are not properly released after use or on abnormal termination, an attacker can repeatedly open connections until the session table is fully consumed. Once exhausted, the device rejects further programming or diagnostic sessions from legitimate operators. The vulnerability requires no authentication and can be triggered remotely across the network.

Root Cause

The root cause is classified as improper resource shutdown or release [CWE-404]. The firmware fails to reclaim session slots when connections terminate abnormally or are abandoned mid-handshake. Each unreleased session permanently occupies a slot in the limited session pool. Attackers do not need valid credentials to open a session, which removes any authentication barrier to resource exhaustion.

Attack Vector

The attack requires network reachability to the Click Plus PLC on the ports used by the Click Programming Software. An attacker sends repeated connection requests, opening the maximum number of sessions the device supports and then either holding them open or forcing incomplete session teardown. This causes availability loss on the industrial control device. See the CISA ICS Advisory ICSA-25-266-01 for vendor-supplied technical details.

Detection Methods for CVE-2025-58473

Indicators of Compromise

Legitimate Click Programming Software connections fail with session-limit or busy errors.
Sustained inbound connection attempts to the Click Plus PLC from unexpected source addresses.
Elevated concurrent session counts on the PLC that do not correspond to authorized engineering activity.
PLC engineering interface becomes unreachable while the device otherwise remains powered and responsive.

Detection Strategies

Monitor network flows to Click Plus C2-03CPU-2 devices and alert on connection rates that exceed operator baselines.
Inspect firewall and switch logs for repeated short-lived or half-open TCP sessions destined for PLC management ports.
Correlate PLC availability events with source IP addresses to identify hosts driving session exhaustion.

Monitoring Recommendations

Baseline normal engineering workstation traffic to PLCs and alert on deviations.
Track PLC connection metrics through ICS-aware network monitoring tools.
Log all access attempts to the Click Programming Software service and forward to a central SIEM or data lake for long-term retention.

How to Mitigate CVE-2025-58473

Immediate Actions Required

Restrict network access to the Click Plus C2-03CPU-2 device so only authorized engineering workstations can reach it.
Place the PLC behind an ICS firewall and block programming ports from general enterprise and internet-facing networks.
Review vendor guidance at AutomationDirect Software Downloads for updated firmware.
Follow the mitigations outlined in CISA ICS Advisory ICSA-25-266-01.

Patch Information

AutomationDirect publishes firmware updates on its software downloads portal. Operators running Click Plus C2-03CPU-2 firmware version 3.60 should check the vendor portal for a firmware release that addresses CVE-2025-58473 and apply it during a scheduled maintenance window. Verify firmware integrity before deployment and confirm rollback procedures are in place.

Workarounds

Segment PLCs onto isolated OT VLANs with strict access control lists.
Require VPN or jump-host access for all engineering sessions to the Click Plus device.
Configure intrusion prevention rules to rate-limit connections to the Click Programming Software service.
Physically or logically disconnect the PLC engineering interface when not actively in use.

bash

# Example firewall rule restricting Click Programming access to a single engineering workstation
iptables -A FORWARD -s 10.10.20.15 -d 10.50.0.10 -p tcp --dport 25425 -j ACCEPT
iptables -A FORWARD -d 10.50.0.10 -p tcp --dport 25425 -j DROP