Productivity Suite CVE-2026-60073

Physical access to the machine running AutomationDirect Productivity Suite is required (AV:P per CVSS vector), along with a low-privileged local account (PR:L). The attacker must be able to interact with the USB subsystem - either by connecting a USB device or controlling the data length parameter passed to a connected USB device. Exploitation is limited by the physical access prerequisite, which eliminates remote and network-based attack paths entirely. There is no user interaction required (UI:N), so once physical and privilege conditions are met, exploitation does not depend on victim action. The vulnerability does not appear to require any non-default configuration of the software - the USB communication path is a standard product function. Factors limiting exploitation: physical site access controls, requirement for a local low-privilege account, and the OT environment's typically air-gapped or access-controlled deployment.

The CVSS 3.1 score of 5.9 (Medium) reflects the physical access requirement (AV:P), which is the dominant risk-dampening factor here. Despite high confidentiality and availability impact ratings (C:H, A:H), the attack is gated by physical proximity to the target machine and a low-privilege account (PR:L) - an attacker cannot exploit this remotely. EPSS data was not provided in the source intelligence, limiting probabilistic exploitation forecasting. No KEV listing exists, and no public proof-of-concept code has been identified. In an ICS/OT context, physical access controls are typically a primary security boundary, so the realistic threat actor is a malicious insider, a contractor with physical site access, or an attacker who has already achieved physical presence. The C:H rating warrants attention in environments handling sensitive process data - kernel memory leakage from an engineering workstation could expose credentials, PLC logic, or network topology. There are no signal conflicts: the physical vector in the description aligns with AV:P in the CVSS vector.

A malicious insider or contractor with physical access to an engineering workstation running Productivity Suite connects a specially crafted USB device or uses a compromised host with attacker-controlled USB data length parameters. By sending a USB payload with a manipulated length value, the attacker triggers an out-of-bounds read in the application, causing either a system crash that disrupts PLC programming operations or leaking kernel memory contents that could expose credentials, session data, or network configuration. No public proof-of-concept code has been identified, but the vulnerability class (CWE-125 with controllable length input) is well understood and reproducible by a skilled researcher.