CVE-2025-55069

A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software implements a predictable seed for its pseudo-random number generator, which compromises the security of the generated private keys.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.automationdirect.com/support/software-downloads
https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de semilla predecible en el generador de números pseudoaleatorios ha sido descubierta en la versión de firmware 3.60 del PLC Click Plus. La vulnerabilidad se basa en el hecho de que el software implementa una semilla predecible para su generador de números pseudoaleatorios, lo que compromete la seguridad de las claves privadas generadas.

Information

Published : 2025-09-23 23:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-55069

Mitre link : CVE-2025-55069

CVE.ORG link : CVE-2025-55069

JSON object : View

Products Affected

No product.

CWE

CWE-337

Predictable Seed in Pseudo-Random Number Generator (PRNG)

{"id": "CVE-2025-55069", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55069", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-24T14:06:23.215875Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "AutomationDirect", "product": "CLICK PLUS C0-0x CPU firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "v3.71", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "CLICK PLUS C0-1x CPU firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "v3.71", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "AutomationDirect", "product": "CLICK PLUS C2-x CPU firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "v3.71", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-23T23:15:30.717", "references": [{"url": "https://www.automationdirect.com/support/software-downloads", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-337"}]}], "descriptions": [{"lang": "en", "value": "A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software implements a predictable seed for its pseudo-random number generator, which compromises the security of the generated private keys."}, {"lang": "es", "value": "Una vulnerabilidad de semilla predecible en el generador de n\u00fameros pseudoaleatorios ha sido descubierta en la versi\u00f3n de firmware 3.60 del PLC Click Plus. La vulnerabilidad se basa en el hecho de que el software implementa una semilla predecible para su generador de n\u00fameros pseudoaleatorios, lo que compromete la seguridad de las claves privadas generadas."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "ics-cert@hq.dhs.gov"}