AutomationDirect Click Programming Software Cleartext Storage of Sensitive Information Vulnerability

A vulnerability exists in AutomationDirect Click Programming Software version 3.60, allowing local users with access to the file system to steal credentials stored in clear text. This exploitation can occur while an administrator session is active.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive credentials, potentially allowing for further exploitation of user accounts or privileges.

Remediation

Users are advised to update Click Programming Software to version 3.80. If an immediate update is not possible, it is recommended to isolate the Click Plus PLC from external networks, restrict access to authorized personnel, and use endpoint protection tools to block unauthorized access attempts.