Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software contains a hard-coded AES key used to protect the initial messages of a new KOPS session.

CVE-2025-58069 identifies a security vulnerability in the firmware version 3.60 of the AutomationDirect CLICK PLUS C0-0x CPU programmable logic controller (PLC). The core issue is the presence of a hard-coded AES cryptographic key embedded within the firmware. This key is used to protect the initial messages exchanged during the establishment of a new KOPS (Key-Operated Protection System) session. The use of a hard-coded key violates cryptographic best practices, as it allows attackers who discover or extract the key to decrypt or forge these initial messages, potentially bypassing authentication or session establishment controls. Since the vulnerability is in the firmware of a PLC, which is a critical component in industrial control systems (ICS), exploitation could lead to unauthorized access or manipulation of industrial processes. The CVSS 4.0 score of 6.9 (medium severity) reflects that the vulnerability is remotely exploitable without authentication or user interaction, with low impact on confidentiality and no impact on integrity or availability as per the vector metrics. No known exploits are currently reported in the wild, and no patches have been released yet. The vulnerability is classified under CWE-321, which covers the use of hard-coded cryptographic keys, a common weakness that undermines cryptographic protections by making keys predictable or extractable. This flaw could be leveraged by attackers to intercept or manipulate communications during the initial KOPS session setup, potentially enabling further attacks on the PLC or the industrial network it controls.

Detailed information about CVE-2025-58069: CWE-321 Use of Hard-coded Cryptographic Key in AutomationDirect CLICK PLUS C0-0x CPU firmware affecting AutomationDir

CVE-2025-58069: CWE-321 Use of Hard-coded Cryptographic Key in AutomationDirect CLICK PLUS C0-0x CPU firmware - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-58069: CWE-321 Use of Hard-coded Cryptographic Key in AutomationDirect CLICK PLUS C0-0x CPU firmware

Threats Tagged 'cve-2025-58069'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-58069'

Lead Pen Test Professional