Productivity Suite CVE-2026-60140

Exploitation requires physical or remote desktop access to a Windows workstation with AutomationDirect Productivity Suite installed, plus a low-privilege (standard user) local account - consistent with CVSS 4.0 metrics AV:L and PR:L. Any user-space process running under a standard user account can open a handle to the kernel driver's device object and issue IOCTL requests, requiring no administrative rights. No user interaction, no specific non-default configuration, and no network connectivity are required beyond local session access. Exploitation is strictly limited to hosts where the Productivity Suite software (and its kernel driver) is installed; PLCs, HMIs, or other network devices are not directly exploitable via this vulnerability. The primary factors limiting exploitation severity are the local-only attack vector and the OT context where workstation access is typically controlled via physical security and least-privilege policies.

The CVSS 4.0 score of 6.9 (Medium) accurately reflects the constrained attack surface: AV:L limits exploitation to local workstation access, PR:L requires at minimum a standard user account, and the impacts split between limited confidentiality (VC:L - partial kernel memory leakage) and high availability (VA:H - potential kernel crash). No subsequent-system impact metrics are set (SC/SI/SA:N), meaning the PLCs themselves are not directly affected by this vulnerability. Despite the moderate CVSS score, the OT deployment context elevates operational risk: a kernel panic on an engineering workstation mid-programming session could interrupt critical PLC configuration or firmware deployment, with downstream effects on industrial processes. The ICS-CERT reporting source lends credibility to the finding. Critically, no EPSS data, KEV listing, or known POC was provided, so the current exploitation probability is assessed as low. The wildcard CPE version field is a data gap - it indicates all versions are potentially affected but does not confirm which versions have been tested or whether older unsupported releases carry higher risk.

An attacker with a standard local user account on a Windows engineering workstation running AutomationDirect Productivity Suite writes a small user-space program that opens a handle to the vulnerable kernel-mode driver device and issues a malformed IOCTL request with an out-of-bounds read offset. The kernel driver reads memory beyond the intended buffer, either leaking kernel pointer values or causing a fatal kernel exception (BSOD), crashing the workstation. No public proof-of-concept code exists at time of analysis, so exploitation currently requires reverse engineering of the driver to identify the vulnerable IOCTL code path.