AutomationDirect Productivity Suite CVE-2025-61934

Exploitation requires network reachability to the ProductivityService PLC simulator component of AutomationDirect Productivity Suite v4.4.1.19, which - per CWE-1327 - binds to an unrestricted IP address (e.g. 0.0.0.0/all interfaces) and listens without authentication, so any host that can route to the service port can invoke its file operations. No credentials, user interaction, or special configuration are needed (PR:N/UI:N/AC:L). The primary limiting factor is deployment topology: this is OT engineering-workstation/simulator software that is normally expected to run on segmented or isolated industrial networks, so realistic exposure depends on whether the affected host is reachable from untrusted or internet-facing segments rather than on any attacker-side prerequisite.

This is a genuine high-priority vulnerability, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3 critical) describes unauthenticated, low-complexity, network-reachable exploitation with high confidentiality, integrity, and availability impact - fully consistent with the description's claim that a remote attacker can read, write, or delete arbitrary files via the ProductivityService PLC simulator. The signals are mostly aligned: the root cause (CWE-1327, binding to an unrestricted/0.0.0.0 IP address) directly explains the AV:N/PR:N rating because the service is reachable by any host that can route to it. The one tension is exposure context: EPSS is only 0.66% (51st percentile), which seems low for a 9.3 flaw, but this is expected for OT/ICS engineering software - it reflects lower internet-wide scanning volume and a smaller, often network-segmented install base rather than low technical severity. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation yet. The practical mitigating factor is deployment: this is an engineering-workstation/simulator service that should sit on an isolated OT network, so real-world risk hinges heavily on whether the affected host is reachable from untrusted segments.

An attacker with network reachability to an engineering workstation running Productivity Suite v4.4.1.19 connects directly to the ProductivityService PLC simulator, which is listening on an unrestricted interface with no authentication. Because the service exposes file operations, the attacker reads sensitive project/configuration files and then writes or deletes arbitrary files to tamper with the host or plant malicious content. No public exploit code is identified at time of analysis, but the low attack complexity (AC:L) and absence of authentication make exploitation straightforward for anyone who can reach the port.