Productivity Suite CVE-2025-58078

The AutomationDirect Productivity Suite ProductivityService PLC simulator component must be running and network-reachable on the target host; the CVSS 4.0 AT:P flag reflects this precondition. Given that state, an unauthenticated remote attacker (PR:N, UI:N) can send a relative path traversal request to write arbitrary file contents outside the intended directory. Limiting factors: the simulator service must be active/exposed rather than firewalled on an isolated engineering workstation, and the attacker needs knowledge of the simulator's protocol since no public exploit exists - exposure of this OT software to untrusted networks is the key real-world gate.

Signals are mixed and point to a moderate, non-urgent priority despite the HIGH 8.3 base score. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack, which is the strongest severity driver, but the AT:P flag indicates a real attack requirement - the ProductivityService PLC simulator must be running and reachable - so exploitation is not purely 'point-and-shoot.' Impact is bounded: VC:N means no confidentiality loss, VI:L is limited integrity, and VA:H (arbitrary file write that can corrupt/overwrite data) is the primary consequence. EPSS is low at 0.62% (48th percentile), the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active or imminent mass exploitation. The low EPSS is consistent with a niche OT engineering-workstation product rather than an internet-scale target. Net: a legitimate HIGH-severity integrity/availability flaw worth patching on OT maintenance cadence, but not a drop-everything emergency absent exposure of the simulator service. Note the impact framing is author-assessed from the vector and description; vendor/NVD have not published a prose impact statement in the provided data.

An attacker with network reachability to a host running the AutomationDirect Productivity Suite ProductivityService PLC simulator sends a crafted request containing a relative path traversal sequence (CWE-23) to write a file with attacker-controlled data outside the intended directory. No authentication is required (PR:N), though the simulator service must be active and reachable (AT:P). No public exploit code is referenced, so this would require custom tooling against the simulator's protocol.