Medium severity · published Oct 23, 2025
CVE-2025-58456
AutomationDirect Productivity Suite Relative Path Traversal
6.8
CVSS
0.6%
EPSS
No
On KEV
Description
A relative path traversal vulnerability was discovered in Productivity Suite software version
4.4.1.19.
The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read arbitrary files on the target machine.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
P1
Productivity 1000 P1-540 CPU · AutomationDirect
before SW v4.4.1.19 · source: vendor
P1
Productivity 1000 P1-550 CPU · AutomationDirect
through SW v4.4.1.19 · source: vendor
P2
Productivity 2000 P2-550 CPU · AutomationDirect
through SW v4.4.1.19 · source: vendor
P2
Productivity 2000 P2-622 CPU · AutomationDirect
through SW v4.4.1.19 · source: vendor
P3
Productivity 3000 P3-530 CPU · AutomationDirect
through SW v4.4.1.19 · source: vendor
P3
Productivity 3000 P3-550E CPU · AutomationDirect
through SW V4.2.1.9 · source: vendor
P3
Productivity 3000 P3-622 CPU · AutomationDirect
through SW V4.2.1.9 · source: vendor
PS
Productivity Suite · AutomationDirect
through SW V4.2.1.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-58456
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-58456
github.com
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json
support.automationdirect.com
https://support.automationdirect.com/docs/securityconsiderations.pdf
www.automationdirect.com
https://www.automationdirect.com/support/software-downloads
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01
More from Productivity 1000 P1-540 CPU
10.0
CVE-2025-61934
AutomationDirect Productivity Suite Binding to an Unrestricted IP Address CWE-1327
8.8
CVE-2025-62498
AutomationDirect Productivity Suite Relative Path Traversal
7.5
CVE-2025-58429
AutomationDirect Productivity Suite Relative Path Traversal
7.5
CVE-2025-58078
AutomationDirect Productivity Suite Relative Path Traversal
7.1
CVE-2025-62688
AutomationDirect Productivity Suite Incorrect Permission Assignment for Critical Resource