Productivity Suite CVE-2026-57896

Exploitation requires a valid local user account on the Windows workstation running AutomationDirect Productivity Suite - the CVSS PR:L vector confirms low-privilege OS credentials are sufficient, with no administrative rights needed. The attacker must be able to open a file handle to the product's kernel driver device object, which is typically accessible to standard user accounts unless explicitly locked down via ACL. No network access, no user interaction, and no special configuration are required beyond the product being installed and its driver loaded. Exploitation is strictly limited to local access: remote unauthenticated attackers cannot reach the IOCTL interface without first compromising a local account on the target workstation. The scope is unchanged (S:U), meaning impact is contained to the affected workstation and does not directly propagate to adjacent OT systems, though operational disruption on the engineering station can have indirect downstream effects.

The CVSS 3.1 score of 6.1 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H reflects the actual attack surface accurately: exploitation is bounded by local access and a low-privilege account, significantly constraining the threat to insider actors or post-compromise lateral movement scenarios. The High availability impact (A:H) is the dominant risk signal and is particularly relevant in OT contexts, where disruption to engineering software can cascade to production line downtime or loss of PLC visibility. The Low confidentiality impact (C:L) suggests partial kernel memory leakage is possible but not a primary exploitation goal. No EPSS data was provided for this CVE, and it is absent from CISA KEV, indicating no confirmed active exploitation. The absence of a public POC further supports a currently low exploitation probability. However, the low attack complexity (AC:L) means that once an attacker has local access, no special timing, race condition, or chaining is required - exploitation would be straightforward for a skilled actor with local presence.

A malicious insider or an attacker who has already established a low-privilege foothold on a Windows engineering workstation running AutomationDirect Productivity Suite opens a handle to the product's kernel driver and sends a crafted IOCTL request with a malformed buffer. The driver reads beyond the allocated buffer boundary, corrupting kernel memory and crashing the application or the system (BSOD), halting any active PLC sessions or engineering operations. No public proof-of-concept has been identified, but the low attack complexity suggests a capable actor with local access could develop one without significant effort.