Productivity Suite CVE-2025-62498

Exploitation requires the attacker to first tamper with a Productivity Suite project file (insert a malicious relative/ZipSlip path into the project archive), and then requires a legitimate user to open that tampered project in Productivity Suite 4.4.1.19 on the target machine. The decisive limiting factors are: (1) the attacker must obtain write access to a project file or otherwise deliver a malicious project (shared drive, email, USB, compromised integrator/supply path), and (2) an engineer must open it - so this is not remote unauthenticated exploitation against a default-exposed service despite the vendor's AV:N/UI:N vector. This is an OT engineering-workstation software flaw, not a network-listening service, which further constrains realistic exploitation to targeted scenarios.

This is a legitimate but conditional risk, not a drop-everything internet-facing emergency. The vendor's CVSS 4.0 vector (base score 8.6) sets AV:N/AC:L/PR:H/UI:N with full high VC/VI/VA impact, but that labeling sits awkwardly against the description: exploitation requires an attacker to tamper with a Productivity project file, with code executing when that project is 'opened' - which strongly implies victim-side file handling (user interaction) rather than a clean remote, no-interaction network attack. CONFLICT TO VERIFY: the vendor marks UI:N and AV:N, yet 'execute code on the machine where the project is opened' reads as a trojanized-project / local-file vector with user interaction - recommend confirming the true delivery path with AutomationDirect's advisory. The EPSS score of 0.54% (44th percentile) is modest and consistent with a social-engineering/supply-path flaw rather than a mass-scanned remote RCE. There is no CISA KEV listing and no public exploit identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis.' Net: a real, high-impact OT engineering-workstation vulnerability worth patching on a normal cycle, but its practical risk is gated by the attacker first needing to modify a project file and the engineer then opening it - not indiscriminate remote exploitation.

An attacker who can modify a Productivity Suite project file (for example via a shared engineering file store, email, USB, or a compromised integrator) embeds a malicious relative path (ZipSlip) inside the project archive. When an engineer opens the tampered project on the OT workstation, extraction writes files outside the intended directory and arbitrary code executes on that machine. No public proof-of-concept exploit is identified at time of analysis.