AutomationDirect Productivity Suite CVE-2025-62688

The attacker must already hold valid low-privileged credentials within AutomationDirect Productivity Suite (v4.4.1.19) and have local access to the engineering software/workstation (AV:L), with no user interaction required. The specific abuse is the ability to change one's own role assignment to obtain full project control. Limiting factors: exploitation is impossible without a pre-existing authenticated low-privileged account and local access, which confines realistic risk to insiders or attackers who have already gained a foothold on the OT engineering host; there is no remote, unauthenticated path.

This is a moderate-risk privilege-escalation flaw (CWE-732) rather than a top-tier emergency. The vendor/NVD CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 6.9 and tells a consistent story: an attacker must already hold valid low-privileged credentials and have local access to the Productivity Suite engineering environment, after which they can elevate their own role to full project control (VI:H/VA:H, VC:N - integrity and availability impact, no confidentiality). Exploitation-probability signals are low and aligned: EPSS is 0.15% (4th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not evidence of active or widespread exploitation. The main reasons to prioritize are contextual rather than probabilistic: it was reported through CISA ICS-CERT (ics-cert@hq.dhs.gov) as an OT/ICS advisory (ICSA-25-296-01), and the affected product is PLC engineering software where an insider or foothold-holding attacker gaining full project control can alter industrial logic. Note the local vector and required authentication sharply limit remote mass exploitation - treat this as an insider/post-compromise integrity risk in OT environments, not an internet-facing worm candidate.

An attacker who already possesses a low-privileged Productivity Suite account on an engineering workstation abuses the incorrect permission assignment to reassign their own account to a higher-privileged role, obtaining full control of the PLC project. From there they can modify or sabotage the industrial automation project. No public exploit code is known, and the attack requires local access and existing authentication.