EUVD-2026-45036
GHSA-w238-3hjf-hv37
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical USB access required (AV:P), low privilege needed (PR:L); read-only flaw yields kernel memory disclosure (C:H) and crash potential (A:H) but no integrity impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory.
AnalysisAI
Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and system stability to a physically-present, low-privileged attacker via manipulated USB data length values. Exploitation can result in disclosure of sensitive kernel memory contents or a full system crash - both significant outcomes in an OT/ICS environment where availability and data integrity are critical. Reported by ICS-CERT under advisory ICSA-26-197-04, with no public exploit code or CISA KEV listing identified at time of analysis.
Technical ContextAI
AutomationDirect Productivity Suite is an industrial control system (ICS) programming and configuration application used to manage Productivity Series PLCs. The vulnerability (CWE-125, Out-of-Bounds Read) resides in the component responsible for handling USB device communications. When sending data to a USB device, the software fails to properly validate or bound the length parameter, allowing an attacker with physical USB access and low system privileges to craft a payload that causes the application to read beyond the allocated memory buffer. This exposes adjacent kernel memory regions - a classic CWE-125 pattern where insufficient length checks on I/O buffers result in memory safety violations. The CPE cpe:2.3:a:automationdirect:productivity_suite:*:*:*:*:*:*:*:* covers all tracked versions with no bounded range, indicating the full release history may be affected.
RemediationAI
The primary remediation is to apply any patched version of AutomationDirect Productivity Suite released in response to ICSA-26-197-04 - the exact fixed version should be confirmed directly via the AutomationDirect software downloads page (https://www.automationdirect.com/support/software-downloads) and the CISA advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04). No specific patch version number was independently confirmed from the available data. As a compensating control, organizations should enforce strict physical access restrictions to engineering workstations running Productivity Suite, including locking server room or control panel access, using USB port blockers or host-based policies to prevent unauthorized USB device attachment, and restricting local logon to authorized personnel only. In environments where patching is operationally constrained, disabling USB ports via BIOS/UEFI or OS-level group policy on engineering workstations reduces the exploitable attack surface, though this may impact legitimate USB-based PLC programming workflows.
More in Productivity Suite
View allLocal privilege escalation in AutomationDirect Productivity Suite programming software stems from an out-of-bounds write
Local privilege escalation in AutomationDirect Productivity Suite lets an authenticated local attacker corrupt kernel me
Out-of-bounds read in AutomationDirect Productivity Suite enables a local low-privileged attacker to corrupt kernel memo
Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and enables denial-of-service on enginee
Divide-by-zero in AutomationDirect Productivity Suite enables a local, low-privileged attacker to crash the application,
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today