EUVD-2026-45038
GHSA-22g8-27fc-wwmw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local OS session (low privilege)
-
DeliveryLaunch or interact with Productivity Suite
-
ExploitSupply input triggering divide-by-zero
-
ExecutionApplication crashes
-
ImpactEngineering workstation software unavailable
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Division safety checks
|
| Exploitation Conditions | The attacker must have local OS access with at least low-level user privileges (PR:L per CVSS 4.0 vector AV:L/PR:L) on a Windows workstation where AutomationDirect Productivity Suite is installed and running. This is strictly a local vulnerability - remote network exploitation is not possible per AV:L. No specific non-default configuration or optional feature is stated as required in the available description; the flaw appears to be present in the core application. Exploitation is categorically limited to a denial-of-service crash (VA:H), with no confidentiality or integrity impact possible (VC:N/VI:N). Key limiting factors: physical or authenticated local session access is required, the impact is confined to a workstation-level application crash with no lateral movement or data exposure, and the target must have the Productivity Suite application installed and accessible to the user. |
| Impact | The CVSS 4.0 score of 6.8 (Medium) accurately reflects the constrained impact of this vulnerability. The local attack vector (AV:L) is the dominant risk-limiting factor - remote exploitation is not possible, which sharply reduces the attack surface compared to network-reachable flaws. Low complexity (AC:L) and no special attack requirements (AT:N) mean that any authenticated local user can reliably trigger the crash without needing to meet race conditions or unusual system states. In an OT/ICS context, however, availability carries outsized operational significance: crashing the engineering workstation software during an active PLC programming or deployment session could disrupt production operations or delay incident response. No EPSS score was provided in the intelligence; KEV status is absent, and no POC has been publicly identified, all of which suggest this is not under active opportunistic exploitation. The realistic threat actor is an insider or a compromised local session on an engineering workstation, not a remote attacker. Risk prioritization should therefore focus on workstation access controls rather than emergency patching urgency. |
| Exploit ScenarioDerived | A low-privileged local user on an OT engineering workstation loads a crafted or malformed project file into AutomationDirect Productivity Suite, causing the application to execute a code path that divides by zero. The resulting unhandled arithmetic exception crashes the application, interrupting any in-progress PLC programming session and requiring a manual restart. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 16, 2026
Divide-by-zero in AutomationDirect Productivity Suite enables a local, low-privileged attacker to crash the application, resulting in a denial-of-service condition on engineering workstations used to program AutomationDirect PLCs. All versions are affected per CPE wildcard data, and the vulnerability was disclosed via CISA ICS advisory ICSA-26-197-04, indicating ICS-CERT involvement and an OT/industrial context. No public exploit or CISA KEV listing has been identified at time of analysis, and exploitation impact is limited strictly to availability - no data exfiltration or tampering is possible.
RemediationAI
Consult CISA ICS advisory ICSA-26-197-04 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04) and the AutomationDirect software downloads page (https://www.automationdirect.com/support/software-downloads) to identify and apply the latest available version of Productivity Suite - a specific patched version number has not been independently confirmed from the provided data and must be verified directly against vendor release notes. As a compensating control, restrict local logon access to engineering workstations running Productivity Suite to authorized engineering personnel only, enforcing least-privilege OS accounts to reduce the pool of users who could trigger this condition. Isolating OT engineering workstations from shared IT networks using network segmentation limits lateral movement opportunities that could precede a local exploit. Disabling shared or guest accounts on these workstations eliminates the lowest-barrier access path. Note that these controls reduce exposure but do not eliminate the vulnerability if insider threat or compromised credentials are the concern.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AutomationDirect Productivity Suite is a Windows-based engineering workstation application used to develop, configure, and deploy logic for AutomationDirect Productivity-series PLCs in industrial control system environments. CWE-369 (Divide By Zero) describes a class of numeric error where a program performs a division operation with a zero-valued denominator, resulting in an unhandled arithmetic exception that typically terminates the process. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) confirms this is a locally triggerable, low-complexity flaw with high availability impact confined to the vulnerable system. The CPE string cpe:2.3:a:automationdirect:productivity_suite:*:*:*:*:*:*:*:* covers all tracked versions with no version floor or ceiling, suggesting the flaw is pervasive across the product line.
Know when Productivity Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local-only trigger with low privileges required; impact is solely a high-severity availability crash with no confidentiality or integrity consequence.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
1DescriptionCVE.org
A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Productivity Suite
View allLocal privilege escalation in AutomationDirect Productivity Suite programming software stems from an out-of-bounds write
Local privilege escalation in AutomationDirect Productivity Suite lets an authenticated local attacker corrupt kernel me
Out-of-bounds read in AutomationDirect Productivity Suite enables a local low-privileged attacker to corrupt kernel memo
Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and enables denial-of-service on enginee
Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and system stability to a physically-pre
Exploit-DB