AutomationDirect Productivity Suite CVE-2025-61977

Exploitation requires local access to an AutomationDirect Productivity Suite v4.4.1.19 installation (or its encrypted project file) and the ability to invoke the software's forgotten-password recovery workflow, which accepts a single correct recovery-question answer in place of the original project password (CWE-640). Limiting factors: the CVSS 4.0 vector is AV:L (no remote reach) and PR:L (attacker needs some existing local privilege), with AC:H reflecting that the attacker must know or successfully guess the specific recovery answer; there is no user-interaction requirement (UI:N). This is not exploitable against a default remote configuration - it is confined to local engineering-workstation access to the project.

This is a genuine but comparatively low-urgency issue. The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N) describes a locally-exploitable flaw requiring existing low-level privileges and high attack complexity - not a remotely reachable, mass-exploitable weakness. EPSS reinforces this: 0.14% probability at the 3rd percentile indicates very low expected exploitation volume. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or opportunistic exploitation. The signals are mutually consistent (low EPSS, local vector, no KEV/POC), so there is no conflict to reconcile here. The headline 7.3 (HIGH) is driven entirely by the full confidentiality/integrity/availability impact on the vulnerable system (VC:H/VI:H/VA:H) once the weak recovery mechanism is abused - not by ease of reach. Note a data gap: the input provides only a CVSS 4.0 vector; no CVSS 3.1 vector or NVD CPE list is supplied, so affected-version scope beyond v4.4.1.19 is not independently confirmed. Net: a real defect worth patching in affected OT engineering workstations, but not an emergency relative to internet-facing, unauthenticated critical flaws.

An attacker with local access to an engineering workstation running Productivity Suite v4.4.1.19 opens an encrypted project and invokes the forgotten-password recovery flow, which only requires correctly answering a single recovery question rather than the original password. By guessing or knowing that one answer, the attacker decrypts the protected PLC project and gains access to its contents. No public exploit code was identified at time of analysis, and high attack complexity plus the need for prior low-level access limit practical abuse.