CVE-2025-55038

MediumCVSS 6.8

Published: 23/09/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

An authorization bypass vulnerability was discovered in Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol used by the Remote PLC application, authenticated low-privilege users can read and modify PLC variables beyond their intended authorization level.

Risk Assessment

A low-privilege user can unauthorizedly read and modify PLC variables, potentially leading to manipulation of an industrial process or data leakage.

Recommendation

Update the Click Plus firmware to a non-vulnerable version and restrict access to the KOPR protocol and Remote PLC application to trusted networks and accounts only.

Other vulnerabilities in Click Plus PLC

CVE-2025-58069Medium
The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the software containing a hard-coded AES key used to protect the initial messages of a new KOPS session.

Original NVD description (English source)

An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated users with low-level access permissions can exploit this vulnerability to read and modify PLC variables beyond their intended authorization level.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS