CVE-2025-67652 - CVE House

Back to Database

Status published Medium CVE-2025-67652

AutomationDirect CLICK Programmable Logic Controller Weak Encoding for Password

6.1 CVSS

Vulnerability Description

An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The absence of robust encryption or secure handling mechanisms increases the likelihood of this type of exploitation, leaving sensitive information more vulnerable.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-67652

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Dylan Chambers Bourgeois of Triskele Labs reported these vulnerabilities to CISA

References

More from AutomationDirect

View All →

AutomationDirect Productivity Suite Incorrect Permission Assignment for Critical Resource

AutomationDirect Productivity Suite Relative Path Traversal

AutomationDirect Productivity Suite Weak Password Recovery Mechanism for Forgotten Password

AutomationDirect Productivity Suite Binding to an Unrestricted IP Address CWE-1327

AutomationDirect Productivity Suite Relative Path Traversal

Affected Vendor

AutomationDirect

View all reports →

Affected Software

CLICK Programmable Logic Controller

Vulnerable Versions:

C0-0x, C0-1x, C2-x, V3.90

Timeline

Official Publish: January 22nd, 2026

Last Modified: January 23rd, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.