EUVD-2026-45024
GHSA-7f5q-frx2-ggqg
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local IOCTL from an authenticated low-priv user (AV:L/PR:L); unreliable/groomed kernel write gives AC:H; kernel EoP yields full C/I/A on the host with no scope change (S:U).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
AnalysisAI
Local privilege escalation in AutomationDirect Productivity Suite lets an authenticated local attacker corrupt kernel memory by issuing a crafted IOCTL request to an out-of-bounds write flaw (CWE-787). Successful exploitation can elevate privileges to SYSTEM/kernel level or crash the host running this engineering workstation software for AutomationDirect Productivity-series PLCs. Reported through CISA ICS-CERT (ICSA-26-197-04); no public exploit identified at time of analysis and no KEV/EPSS signal is present.
Technical ContextAI
Productivity Suite is AutomationDirect's programming and configuration software for the Productivity1000/2000/3000 line of programmable logic controllers, run on Windows engineering workstations in OT/ICS environments. The vulnerability lives in a kernel-mode driver component that exposes an IOCTL (I/O control) interface to user space; the driver fails to validate the size or bounds of attacker-supplied data before writing it, producing an out-of-bounds write (CWE-787, a classic memory-corruption/buffer-overflow class). Because the faulty write occurs in kernel context, controlled corruption of adjacent kernel structures can be leveraged for arbitrary code execution at ring 0, while uncontrolled corruption typically manifests as a bugcheck/system crash.
RemediationAI
Patch available per vendor advisory: download and install the fixed Productivity Suite release from AutomationDirect's software downloads portal (https://www.automationdirect.com/support/software-downloads) and follow the guidance in CISA advisory ICSA-26-197-04 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04); an exact fixed version number was not provided in the source data, so confirm the target build against the advisory before deployment. Until patched, reduce local-attacker exposure by restricting interactive and remote-desktop login on engineering workstations to trusted operators only (limits the required low-privilege foothold, at the cost of tighter access management), enforcing least-privilege user accounts so day-to-day operators cannot load or interact with the vulnerable driver, and applying network segmentation to keep engineering stations off general IT/user networks per standard ICS practice (reduces the chance an attacker gains the local session, but does not remove the driver flaw). Removing or uninstalling Productivity Suite from any workstation that does not actively need it eliminates the attack surface entirely on those hosts.
More in Productivity Suite
View allLocal privilege escalation in AutomationDirect Productivity Suite programming software stems from an out-of-bounds write
Out-of-bounds read in AutomationDirect Productivity Suite enables a local low-privileged attacker to corrupt kernel memo
Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and enables denial-of-service on enginee
Divide-by-zero in AutomationDirect Productivity Suite enables a local, low-privileged attacker to crash the application,
Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and system stability to a physically-pre
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today