Skip to content
OpenAdvisories
Medium ICSA-26-022-02 2 CVEs

AutomationDirect CLICK Programmable Logic Controller

Published Jan 22, 2026 · Updated Jan 22, 2026

Vendor: Automation Direct Product: CLICK Programmable Logic Controller

Summary

Successful exploitation of these vulnerabilities could allow an attacker to impersonate users, escalate privileges, gain unauthorized access to systems and services, and decrypt sensitive data.

Vulnerabilities 2

  • Medium 6.1
    CVE-2025-25051

    AutomationDirect CLICK Programmable Logic Controller Plaintext Storage of a Password

    An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks.

    Automation Direct CLICK Programmable Logic Controller
  • Medium 6.1
    CVE-2025-67652

    AutomationDirect CLICK Programmable Logic Controller Weak Encoding for Password

    An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The absence of robust encryption or secure handling mechanisms increases the likeliho…

    Automation Direct CLICK Programmable Logic Controller

Revision history

  1. #1

    Initial Publication

References