EUVD-2026-45024
GHSA-7f5q-frx2-ggqg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv local session on engineering workstation
-
DeliveryOpen vulnerable Productivity Suite kernel driver handle
-
ExploitSend crafted IOCTL with malformed size
-
ExecutionTrigger out-of-bounds kernel write (CWE-787)
-
PersistGroom corruption to overwrite kernel structure
-
ImpactEscalate to SYSTEM / kernel privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access with an already-authenticated low-privileged session (CVSS PR:L, AV:L) on a Windows host that has AutomationDirect Productivity Suite installed, plus the ability to open and send IOCTL requests to its kernel driver - there is no remote or network path and no user interaction by a victim is needed (UI:N). Exploitation is limited by high attack complexity (AC:H): the out-of-bounds write is not trivially controllable and reliable privilege escalation likely depends on memory-layout grooming or winning a race, so many attempts may only cause a system crash rather than code execution. It only applies where the software (and its vulnerable driver) is actually installed, i.e. engineering/programming workstations rather than the PLCs themselves. |
| Impact | The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N, base 7.3) frames this as a locally-exploitable, high-complexity, low-privilege issue with high confidentiality, integrity and availability impact to the vulnerable system but no scope change to other systems - consistent with a driver-level EoP rather than a remotely wormable flaw. The AC:H metric indicates the write is not trivially controllable (likely requiring specific timing, memory grooming, or a race), which meaningfully lowers real-world exploitability. There is no CISA KEV listing and no EPSS score provided, and no POC has been identified, so there is no evidence of active or imminent exploitation. Net: this is a genuine but moderate-priority local EoP - an attacker must already have a foothold (valid low-privilege login on the engineering workstation) and overcome high attack complexity, so it is a defense-in-depth patch rather than an emergency, though in OT contexts kernel EoP on an engineering station warrants prompt attention. |
| Exploit ScenarioDerived | An attacker who has already obtained a low-privileged interactive session on an engineering workstation (via phishing, stolen operator credentials, or an insider) runs a small user-mode program that opens the Productivity Suite driver and sends a crafted IOCTL with malformed size/offset fields. The out-of-bounds kernel write is groomed to overwrite a kernel structure, escalating the process to SYSTEM and giving the attacker full control of the OT engineering host; a botched attempt instead bugchecks the machine. No public POC is currently known, and the CVSS AC:H reflects that reliable exploitation requires non-trivial effort. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 16, 2026
Local privilege escalation in AutomationDirect Productivity Suite lets an authenticated local attacker corrupt kernel memory by issuing a crafted IOCTL request to an out-of-bounds write flaw (CWE-787). Successful exploitation can elevate privileges to SYSTEM/kernel level or crash the host running this engineering workstation software for AutomationDirect Productivity-series PLCs. Reported through CISA ICS-CERT (ICSA-26-197-04); no public exploit identified at time of analysis and no KEV/EPSS signal is present.
RemediationAI
Patch available per vendor advisory: download and install the fixed Productivity Suite release from AutomationDirect's software downloads portal (https://www.automationdirect.com/support/software-downloads) and follow the guidance in CISA advisory ICSA-26-197-04 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04); an exact fixed version number was not provided in the source data, so confirm the target build against the advisory before deployment. Until patched, reduce local-attacker exposure by restricting interactive and remote-desktop login on engineering workstations to trusted operators only (limits the required low-privilege foothold, at the cost of tighter access management), enforcing least-privilege user accounts so day-to-day operators cannot load or interact with the vulnerable driver, and applying network segmentation to keep engineering stations off general IT/user networks per standard ICS practice (reduces the chance an attacker gains the local session, but does not remove the driver flaw). Removing or uninstalling Productivity Suite from any workstation that does not actively need it eliminates the attack surface entirely on those hosts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Productivity Suite is AutomationDirect's programming and configuration software for the Productivity1000/2000/3000 line of programmable logic controllers, run on Windows engineering workstations in OT/ICS environments. The vulnerability lives in a kernel-mode driver component that exposes an IOCTL (I/O control) interface to user space; the driver fails to validate the size or bounds of attacker-supplied data before writing it, producing an out-of-bounds write (CWE-787, a classic memory-corruption/buffer-overflow class). Because the faulty write occurs in kernel context, controlled corruption of adjacent kernel structures can be leveraged for arbitrary code execution at ring 0, while uncontrolled corruption typically manifests as a bugcheck/system crash.
Know when Productivity Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local IOCTL from an authenticated low-priv user (AV:L/PR:L); unreliable/groomed kernel write gives AC:H; kernel EoP yields full C/I/A on the host with no scope change (S:U).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
Executive ViewAI
A local privilege escalation vulnerability in AutomationDirect Productivity Suite (CVE-2026-60063, CVSS 7.3) enables authenticated users with local workstation access to escalate privileges to SYSTEM level or crash the engineering workstation. This threatens organizations managing industrial automation systems, as a compromised workstation could allow attackers to modify PLC configurations, disrupt production operations, or cause unplanned downtime. Patch availability is absent at this time.
Restrict local logon access to authorized engineering personnel and enforce multi-factor authentication for privileged access where technically feasible; deploy EDR monitoring to detect suspicious kernel-level access patterns and privilege escalation attempts; implement network segmentation isolating workstations from general corporate networks and internet access; maintain offline backups of all critical PLC configurations to enable rapid recovery; enforce application whitelisting on affected systems; apply all available operating system security patches and system hardening controls; audit and minimize local user accounts with administrative privileges; implement file integrity monitoring on PLC configuration files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Productivity Suite
View allLocal privilege escalation in AutomationDirect Productivity Suite programming software stems from an out-of-bounds write
Out-of-bounds read in AutomationDirect Productivity Suite enables a local low-privileged attacker to corrupt kernel memo
Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and enables denial-of-service on enginee
Divide-by-zero in AutomationDirect Productivity Suite enables a local, low-privileged attacker to crash the application,
Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and system stability to a physically-pre
Exploit-DB