AutomationDirect Click Plus PLC Predictable Seed in Pseudo-Random Number Generator Vulnerability

A vulnerability has been identified in the Click Plus PLC firmware version 3.60, where a predictable seed in the pseudo-random number generator compromises the security of generated private keys. This vulnerability allows for the potential manipulation of cryptographic operations, as the predictability of the seed can be exploited to reproduce random values used in key generation.

Impact

Exploitation of this vulnerability compromises the security of cryptographic keys, allowing for unauthorized access or manipulation of data protected by these keys.

Remediation

Users are advised to update the Click Plus PLC firmware to version 3.80. If an immediate update is not possible, it is recommended to isolate the PLC from external networks, restrict access to authorized personnel, and use secure internal communications.