AutomationDirect CLICK PLUS Predictable Seed in Pseudo-Random Number Generator
A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software implements a predictable seed for its pseudo-random number generator, which compromises the security of the generated private keys.
AutomationDirect CLICK PLUS Predictable Seed in Pseudo-Random Number Generator
A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software implements a predictable seed for its pseudo-random number generator, which compromises the security of the generated private keys.
AutomationDirect recommends that users update CLICK PLUS and firmware to V3.80. https://www.automationdirect.com/support/software-downloads
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed:
* Network Isolation – Disconnect the CLICK PLUS PLC from external networks (e.g., the internet or corporate LAN) to reduce exposure.
* Secure Communications – Use only trusted, dedicated internal networks or air-gapped systems for device communication.
* Access Control – Restrict both physical and logical access to authorized personnel only.
* Application Whitelisting – Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
* Endpoint Protection – Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
* Logging & Monitoring – Enable and regularly review system logs to detect suspicious or unauthorized activity.
* Backup & Recovery – Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.
* Ongoing Risk Assessment – Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Configurations
Workarounds
Exploits
Credits
finder
Luca Borzacchiello and Diego Zaffaroni of Nozomi Networks reported these vulnerabilities to Automation Direct.
A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software implements a predictable seed for its pseudo-random number generator, which compromises the security of the generated private keys.
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
AutomationDirect CLICK PLUS Use of a Broken or Risky Cryptographic Algorithm
The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software uses an insecure implementation of the RSA encryption algorithm.