Paper/Archive/CVE-2025-61934

CVE-2025-61934

AutomationDirect Productivity Suite — AutomationDirect Productivity Suite Binding to an Unrestricted IP Address CWE-1327

EPSS 0.7%CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 51.7.517 × 2010.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read, write, or delete arbitrary files and folders on the target machine

Affected

ProductAffectedFixed inSource

Productivity Suite≤ SW V4.2.1.9–CNA

Productivity 3000 P3-622 CPU≤ SW V4.2.1.9–CNA

Productivity 3000 P3-550E CPU≤ SW V4.2.1.9–CNA

Productivity 3000 P3-530 CPU≤ SW v4.4.1.19–CNA

Productivity 2000 P2-622 CPU≤ SW v4.4.1.19–CNA

Productivity 2000 P2-550 CPU≤ SW v4.4.1.19–CNA

Productivity 1000 P1-550 CPU≤ SW v4.4.1.19–CNA

Productivity 1000 P1-540 CPU< SW v4.4.1.19SW v4.4.1.19CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-25-296-01 refautomationdirect.com/support/software-downloads refsupport.automationdirect.com/docs/securityconsiderations.pdf refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json