AutomationDirect Click Plus PLC Hard-Coded Cryptographic Key Vulnerability

A vulnerability exists in AutomationDirect Click Plus PLC firmware version 3.60, where a hard-coded AES key is used to secure initial messages in a new KOPS session. This flaw allows for potential unauthorized access or manipulation of session data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to session data, allowing for interception or manipulation of communications within the KOPS session.

Remediation

Users are advised to update the Click Plus PLC firmware to version 3.80. If an immediate update is not possible, it is recommended to isolate the PLC from external networks, restrict access to authorized personnel, and use secure internal communications.