PT-2025-43570 · Automationdirect · Productivity Suite

Luca Borzacchiello · Published 2025-10-23 · Updated 2025-10-28 · CVE-2025-61934

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Productivity Suite version v4.4.1.19

Description A flaw exists due to a binding to an unrestricted IP address in the ProductivityService PLC simulator. This allows an unauthenticated remote attacker to interact with the simulator. Successful exploitation can lead to the ability to read, write, or delete arbitrary files and folders on the affected system.

Recommendations Update Productivity Suite to a newer version that resolves this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1327

Related Identifiers

CVE-2025-61934

Affected Products

Productivity Suite

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-61934 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json · Note
• https://twitter.com/0dayPublishing/status/1981483114019905872 · Twitter Post
• https://t.me/CVEtracker/35620 · Telegram Post
• https://twitter.com/CveTodo/status/1983115307951489329 · Twitter Post
• https://twitter.com/offseq/status/1981511858348527905 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-296-01 · Note
• https://automationdirect.com/support/software-downloads · Note
• https://twitter.com/CveFindCom/status/1981483234329280758 · Twitter Post
• https://support.automationdirect.com/docs/securityconsiderations.pdf · Note
• https://twitter.com/SecAideInfo/status/1982390109992349936 · Twitter Post
• https://twitter.com/CVEnew/status/1981489135660782018 · Twitter Post