Historical intelligence backfill. This assessment covers reporting originally published on 2025-09-23 and was added to the RWP archive on 2026-09-07.

CISA's 23 September ICS six-pack was a protocol-trust problem, led by CLICK PLUS

AutomationDirect CLICK PLUS crypto and authorization flaws sat in the same CISA alert as Mitsubishi MELSEC-Q, Viessmann Vitogate, Schneider SESU, and Hitachi Energy RTU500 updates.

RWP Ventures · 2026-09-07 · event 2025-09-23 · 5 min read · priority 7.8

This assessment also covers the later Nozomi Networks protocol analysis (26 November 2025) of the same CLICK PLUS issues. Registry OT-028 is merged here. Historical backfill: source date 23 September 2025; added to the RWP archive 7 September 2026.

What happened

CISA named:

• ICSA-25-266-01 AutomationDirect CLICK PLUS
• ICSA-25-266-02 Mitsubishi Electric MELSEC-Q Series CPU Module
• ICSA-25-266-03 Schneider Electric SESU
• ICSA-25-266-04 Viessmann Vitogate 300
• ICSA-25-023-02 Hitachi Energy RTU500 Series (Update A)
• ICSA-25-093-01 Hitachi Energy RTU500 Series (Update B)

ICSA-25-266-01 is the one to read first. CISA scored the set CVSS v4 8.7, marked it exploitable remotely with low attack complexity, and listed CWE-312, CWE-321, CWE-327, CWE-337, CWE-404, and CWE-862. Affected firmware: CLICK PLUS C0-0x, C0-1x, and C2-x CPU families prior to v3.71. AutomationDirect's fix path was firmware/software to V3.80, with network isolation as the compensating control if the outage could not happen immediately.

CVE-2025-58069 is the hard-coded AES key used to protect the start of a KOPS session — that is a protocol-trust failure, not a "remember to patch Windows" failure. CVE-2025-54855 is local cleartext credential storage in Click Programming Software while an admin session is active. Other CVEs in the same advisory cover broken crypto, a predictable PRNG seed, resource exhaustion, and missing authorization.

Two months later, Nozomi Networks Labs published how they found the seven issues on a C2-03CPU-2 (Wi-Fi and Bluetooth) and coordinated with AutomationDirect. That paper does not create a new incident. It confirms the CISA list was research-driven disclosure, not rumor.

Why it mattered

CLICK PLUS is a small PLC. That is the point. Compact controllers show up in packaging lines, building equipment, remote skids, and, as Nozomi noted, even amusement-park rides. They are bought by electricians, not by a corporate OT program. They often have Wi-Fi or Bluetooth because that is how the vendor sold convenience.

"Encrypted protocol" on a PLC is frequently a marketing sentence. A hard-coded session key plus a predictable seed means a network observer or a peer on the same segment can graduate from "I see traffic" to "I can speak the engineering dialect." Missing authorization then turns that dialect into setting changes or denial of service.

Vitogate 300 (heating) and Hitachi RTU500 (transmission/distribution) are different products with the same lesson: protocol and remote-management trust on long-lived field devices.

OT compromise: not claimed. This batch is CONFIRMED vulnerability research. No RWP-reviewed source showed these CVEs used in a named intrusion on 23 September 2025.

Who / what was affected

• Plants and OEMs running CLICK PLUS firmware before v3.71, especially C2 units with wireless.
• Engineering laptops with Click Programming Software (cleartext credential issue is local).
• Mitsubishi MELSEC-Q CPU owners (legacy Q-series remains common; treat as a scheduled CPU/engineering-station item).
• Schneider SESU and Viessmann Vitogate 300 in buildings and district energy.
• Hitachi Energy RTU500 operators who had not applied the earlier 2025 advisories — Update A/B means you may already be late.

Critical manufacturing is the CISA sector tag on CLICK PLUS. That is a catalog tag, not evidence of a specific victim.

Technical context

Defenders should demand three properties from any "encrypted" engineering protocol:

1. Device-unique keys, not firmware-global keys.
2. Authentication of the engineering station, not just confidentiality of bytes.
3. Authorization distinct from "got on the wire."

CLICK PLUS failed that test in v3.60-era firmware. Wireless interfaces increase the chance the wire is not a locked cabinet.

RWP is not publishing session structure, key values, or exploit steps. CISA and Nozomi already documented what operators need to prioritize patching.

Exploitation / threat status at the time

CONFIRMED disclosure 23 September 2025; vendor fix V3.80; Nozomi coordination later described as prompt.

REPORTED no public exploit code cited in the CISA advisory; CIRCL/CISA coordinator notes on some CVEs listed exploitation as none at coordination time.

UNKNOWN whether any CLICK PLUS with wireless was already in a botnet or scanned massively that week.

ASSESSED (moderate): once product names and "hard-coded key" appear in CISA, internet-facing units become a research target.

What defenders should have done

1. Firmware to V3.80 (or vendor-current) on every CLICK PLUS, including spares. Programming software too — the cleartext credential bug is on the laptop.
2. If the PLC cannot move this week: pull it off WAN and off site Wi-Fi. Dedicated L2, no Bluetooth pairing left on for convenience.
3. Restrict who can run Click Programming Software; treat the engineering PC as a high-value asset.
4. For MELSEC-Q, Vitogate, SESU, RTU500: same exposure check, then vendor firmware. RTU500 updates imply prior incomplete remediation.
5. Add compact/OEM PLCs to the asset inventory. If the only list is "Rockwell and Siemens," CLICK PLUS is already the hole.

What we know now

Nozomi's November 2025 write-up is the technical coda, not a second event. Later registry items on engineering-workstation trust (Productivity Suite, CODESYS) are the same pattern on other vendors. RWP is not merging those here.

RWP assessment

Confidence: High on the CISA product list, CLICK PLUS CVE classes, and vendor fix version. Moderate that CLICK PLUS was the correct priority inside the six-pack. Low on in-the-wild use.

Merging OT-028 (Nozomi CLICK PLUS protocol paper) into this assessment avoids two posts about one firmware family.

Defensive actions

1. Inventory CLICK PLUS / MELSEC-Q / Vitogate / SESU / RTU500 this week, not after the next CISA six-pack.
2. Disable wireless on C2-class CLICK PLUS unless there is a written reason.
3. Monitor engineering-protocol sessions to compact PLCs from unexpected hosts.
4. Do not call this an OT breach. Call it an OT trust-boundary defect and close it.