AutomationDirect Productivity Suite CVE-2025-58429

Exploitation requires that the AutomationDirect Productivity Suite (v4.4.1.19) ProductivityService PLC simulator component be running and network-reachable by the attacker; the CVSS 4.0 AT:P flag reflects this as a required attack precondition rather than a default-everywhere exposure. No authentication is needed (PR:N) and no user interaction is required (UI:N), so any party able to reach the active simulator service can trigger it. The practical limiting factor is that the simulator - a development/simulation feature - must be active and exposed; environments that do not run or do not expose this service are not reachable. Impact is limited to file deletion (integrity/availability), with no confidentiality exposure.

Signals conflict in a way that pulls this below its headline CVSS 4.0 base score of 8.3. The vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes network-reachable, unauthenticated, low-complexity access, which sounds urgent, but the AT:P flag indicates a specific attack requirement must be met - here, the ProductivityService PLC simulator must be running and reachable - so it is not a blanket default-config remote hole. Impact is scoped to integrity and availability of files (VI:L/VA:H/SI:L/SA:L) with no confidentiality exposure (VC:N), reflecting arbitrary file deletion rather than code execution or data theft. The EPSS probability is low (0.62%, 48th percentile), there is no CISA KEV listing and no public exploit identified, which collectively argue against widespread opportunistic exploitation. This is a legitimately serious ICS/OT integrity-and-availability bug worth patching on managed industrial maintenance cycles, but the absence of exploitation evidence and the simulator-running precondition make it a moderate operational priority rather than an emergency. Note the discrepancy to verify: the CVSS vector asserts AV:N unauthenticated network access, yet exploitation depends on the simulator component being active, which is a deployment-specific condition not reflected as attack complexity - confirm the exposure model with AutomationDirect/CISA advisory icsa-25-296-01.

An attacker who can reach a host running the AutomationDirect Productivity Suite ProductivityService PLC simulator sends a crafted request containing a relative path-traversal sequence, without authenticating. The request escapes the intended directory and causes deletion of arbitrary files on the target machine, potentially removing project, configuration, or system files and disrupting the simulation or host. No public exploit code has been identified, and exploitation requires the simulator service to be running and network-reachable.