AutomationDirect Productivity Suite CVE-2025-59776

The target must be running AutomationDirect Productivity Suite 4.4.1.19 with the ProductivityService PLC simulator component reachable over the network to the attacker; the CVSS 4.0 AT:P metric indicates exploitation requires this simulator service to be active/reachable rather than being universally exploitable against any default install. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N). Limiting factors: impact is confined to creating arbitrary directories (integrity-only, VI:L/SI:L) with no code execution, data disclosure, or denial of service; typical ICS deployment practice of isolating/segmenting engineering workstations and simulator services from untrusted networks substantially reduces real-world reachability.

This is a moderate-severity ICS/OT vulnerability (CVSS 4.0 base 6.3) rather than a critical priority, and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes network-reachable, unauthenticated access but with AT:P (Attack Requirements present), meaning exploitation depends on specific conditions around the ProductivityService PLC simulator being reachable/active. Impact is deliberately narrow: only partial integrity (VI:L, SI:L) with no confidentiality (VC:N) and no availability (VA:N) impact - the attacker can create arbitrary directories, not read data, execute code, or crash the service, per the description. EPSS is low at 0.51% (42nd percentile), the CVE is NOT in CISA KEV, and no public POC is identified, so there is no evidence of active or imminent widespread exploitation. The reporter is CISA ICS-CERT (ics-cert@hq.dhs.gov) with an associated ICS advisory (ICSA-25-296-01), which raises confidence in the finding's legitimacy but does not indicate exploitation. Net: a legitimately network-exploitable unauthenticated flaw whose low real-world risk is driven by limited technical impact (directory creation only) and the attack-requirement precondition, not a high-urgency item. No signals conflict.

An attacker with network reachability to an exposed ProductivityService PLC simulator endpoint sends crafted requests containing relative path-traversal sequences (CWE-23) to the directory-handling functionality. Because no authentication is required (PR:N), the attacker causes the service to create arbitrary directories outside the intended path on the target machine. No public exploit code is identified at time of analysis, and exploitation depends on the simulator service being reachable (AT:P).