Medium · 6.1 CVE-2025-25051 EUVD-2026-4505GHSA-4xvg-4w2r-qph8

AutomationDirect CLICK Programmable Logic Controller Plaintext Storage of a Password

Published Jan 22, 2026 · Updated Jan 23, 2026 · Assigned by icscert

Vendor: Automation Direct Product: CLICK Programmable Logic Controller

Description

An attacker could decrypt sensitive data, impersonate legitimate users
or devices, and potentially gain access to network resources for lateral
attacks.

Affected products

Vendor	Product	Affected	Fixed
AutomationDirect	CLICK Programmable Logic Controller	C0-0x, C0-1x, C2-x	V3.90

Advisories 1

ICSA-26-022-02 AutomationDirect CLICK Programmable Logic Controller CISA ICS & IT advisories · Jan 22, 2026

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-02
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-022-02.json

CNA	v3.1	6.1
EUVD	v3.1	6.1