AutomationDirect Productivity Suite CVE-2025-60023

Exploitation requires that the ProductivityService component - the PLC simulator feature of Productivity Suite 4.4.1.19 - be running and network-reachable from the attacker; the flaw is triggered by sending relative path traversal sequences to this service. No authentication (PR:N) and no user interaction (UI:N) are needed. The limiting factors are the AT:P attack requirement (the simulator service must be active/exposed) and typical OT deployment practice, where engineering-workstation software like this is frequently on segmented or firewalled networks rather than directly internet-exposed; impact is confined to directory deletion (integrity), not code execution or data disclosure.

This is a medium-severity (CVSS 4.0 base 6.3) relative path traversal (CWE-23) in AutomationDirect Productivity Suite 4.4.1.19, reported through CISA ICS-CERT (ICSA-25-296-01). The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation, but the AT:P flag signals a present attack requirement - exploitation depends on the ProductivityService PLC simulator being active/reachable, which tempers the raw network vector. Impact is limited to integrity (directory deletion) with no confidentiality and, per the vendor vector, VA:N - meaning it is scored as a data-tampering/deletion issue rather than full service denial, even though arbitrary directory deletion can plausibly degrade availability in practice (a point worth verifying with the vendor). The signals are consistent and point to a real-but-bounded risk: EPSS is low at 0.51% (42nd percentile), there is no CISA KEV listing and no public exploit identified, so this is a prioritize-for-patching issue rather than an emergency. The low real-world urgency is reinforced by the product's niche OT/engineering-workstation footprint; the main caveat is that the 'unauthenticated remote' framing should be weighed against the AT:P requirement and the fact that PLC engineering software is often (but not always) on segmented OT networks.

An attacker with network reachability to a workstation running the ProductivityService PLC simulator sends crafted requests containing relative path traversal sequences (e.g., ../) to the simulator interface, without authenticating. By escaping the intended directory, the attacker causes the service to delete arbitrary directories on the host, corrupting project data or system files. No public exploit code or active exploitation has been identified at the time of analysis.