EUVD-2026-45036
GHSA-w238-3hjf-hv37
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical USB access required (AV:P), low privilege needed (PR:L); read-only flaw yields kernel memory disclosure (C:H) and crash potential (A:H) but no integrity impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory.
AnalysisAI
Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and system stability to a physically-present, low-privileged attacker via manipulated USB data length values. Exploitation can result in disclosure of sensitive kernel memory contents or a full system crash - both significant outcomes in an OT/ICS environment where availability and data integrity are critical. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical access to the machine running AutomationDirect Productivity Suite is required (AV:P per CVSS vector), along with a low-privileged local account (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.9 (Medium) reflects the physical access requirement (AV:P), which is the dominant risk-dampening factor here. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious insider or contractor with physical access to an engineering workstation running Productivity Suite connects a specially crafted USB device or uses a compromised host with attacker-controlled USB data length parameters. By sending a USB payload with a manipulated length value, the attacker triggers an out-of-bounds read in the application, causing either a system crash that disrupts PLC programming operations or leaking kernel memory contents that could expose credentials, session data, or network configuration. … |
| Remediation | The primary remediation is to apply any patched version of AutomationDirect Productivity Suite released in response to ICSA-26-197-04 - the exact fixed version should be confirmed directly via the AutomationDirect software downloads page (https://www.automationdirect.com/support/software-downloads) and the CISA advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Productivity Suite
View allLocal privilege escalation in AutomationDirect Productivity Suite programming software stems from an out-of-bounds write
Local privilege escalation in AutomationDirect Productivity Suite lets an authenticated local attacker corrupt kernel me
Out-of-bounds read in AutomationDirect Productivity Suite enables a local low-privileged attacker to corrupt kernel memo
Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and enables denial-of-service on enginee
Divide-by-zero in AutomationDirect Productivity Suite enables a local, low-privileged attacker to crash the application,
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today