CVE-2025-67652 AutomationDirect CVE debrief

Who should care

OT/ICS teams running AutomationDirect CLICK PLC or CLICK PLUS systems, especially engineers, integrators, and administrators who store, share, or transfer project files. Organizations with shared engineering workstations, backup repositories, or broad access to PLC project files should pay particular attention.

Technical summary

The issue is described as exposed credentials within a project file, with insufficient encryption or secure handling increasing the likelihood of misuse. The supplied CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) and advisory language indicate a local-access path centered on project-file access rather than a broad remote exploit. Impact is primarily confidentiality and limited integrity, with potential privilege escalation and unauthorized access.

Defensive priority

Medium, but treat as higher priority if project files are widely accessible, copied between systems, or stored in shared locations. Remediation is straightforward and vendor guidance is available.

Recommended defensive actions

• Update CLICK PLUS firmware to V3.90 using AutomationDirect’s supported software downloads.
• If patching must be delayed, isolate the PLC from external networks and limit communication to trusted internal or air-gapped environments.
• Restrict physical and logical access to authorized personnel only, including access to project files and engineering workstations.
• Use application whitelisting and host-based firewalling to reduce unauthorized software and access attempts.
• Enable logging and monitoring, and review logs for suspicious access to project files or PLC-related systems.
• Maintain secure, tested backups of PLC configurations and monitor ongoing risk from any outdated firmware remaining in service.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-022-02 for AutomationDirect CLICK Programmable Logic Controller and the included vendor remediation guidance. The advisory describes exposed credentials in project files and recommends upgrading CLICK PLUS firmware to V3.90. No KEV listing or ransomware-campaign designation was supplied. Timing is based on the advisory/CVE publication date of 2026-01-22.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.