What’s Vulnerable › Vulnerabilities

CVE-2025-60023: AutomationDirect Productivity Suite Relative Path Traversal

• Severity: medium (CVSS 4.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-23 · updated 2026-10-18
• Weakness: CWE-23

Description

A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary directories on the target machine.

Affected products

• AutomationDirect Productivity 1000 P1-540 CPU: before SW v4.4.1.19 — fixed in SW v4.4.1.19
• AutomationDirect Productivity 1000 P1-550 CPU: through SW v4.4.1.19
• AutomationDirect Productivity 2000 P2-550 CPU: through SW v4.4.1.19
• AutomationDirect Productivity 2000 P2-622 CPU: through SW v4.4.1.19
• AutomationDirect Productivity 3000 P3-530 CPU: through SW v4.4.1.19
• AutomationDirect Productivity 3000 P3-550E CPU: through SW V4.2.1.9
• AutomationDirect Productivity 3000 P3-622 CPU: through SW V4.2.1.9
• AutomationDirect Productivity Suite: through SW V4.2.1.9

How to fix

Upgrade to a fixed version: AutomationDirect Productivity 1000 P1-540 CPU SW v4.4.1.19. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json
• https://support.automationdirect.com/docs/securityconsiderations.pdf
• https://www.automationdirect.com/support/software-downloads
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01

Get alerted when CVE-2025-60023 or the next vulnerability affects your stack