CVE-2025-58069

MediumCVSS 5.3

Published: 23/09/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the software containing a hard-coded AES key used to protect the initial messages of a new KOPS session.

Risk Assessment

The hard-coded AES key can be extracted from the software and used to decrypt or impersonate the initial KOPS session communication, weakening confidentiality and integrity.

Recommendation

Update the firmware to a version where the key is not hard-coded and implement unique per-device keys.

Other vulnerabilities in Click Plus PLC

CVE-2025-55038Medium
An authorization bypass vulnerability was discovered in Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol used by the Remote PLC application, authenticated low-privilege users can read and modify PLC variables beyond their intended authorization level.

Original NVD description (English source)

The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software contains a hard-coded AES key used to protect the initial messages of a new KOPS session.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS