CVE-2025-61934
AutomationDirect Productivity Suite Binding to an Unrestricted IP Address CWE-1327
In short
The Productivity Suite software listens on all network addresses without restrictions, allowing anyone on the network to access a PLC simulator tool and manipulate files on the affected computer without needing a password.
Technical detail
The ProductivityService binds to an unrestricted IP address (0.0.0.0 or ::), exposing an unauthenticated PLC simulator interface accessible to remote attackers. This enables arbitrary file read, write, and delete operations on the host system without authentication or authorization checks.
Summary generated and translated by AI from the official description.
A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read, write, or delete arbitrary files and folders on the target machine
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected products
AutomationDirect · Productivity 1000 P1-540 CPUAutomationDirect · Productivity 1000 P1-550 CPUAutomationDirect · Productivity 2000 P2-550 CPUAutomationDirect · Productivity 2000 P2-622 CPUAutomationDirect · Productivity 3000 P3-530 CPUAutomationDirect · Productivity 3000 P3-550E CPUAutomationDirect · Productivity 3000 P3-622 CPUAutomationDirect · Productivity SuiteWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →