CVE-2025-61934: Productivity Suite 0 through SW V4.2.1.9; +7 more affected products

CVE-2025-61934. CVSS 3.1 base score 10.0 (CRITICAL, Vendor/CNA). EPSS 0.00663 (percentile 0.5072), scored 17-Oct-2026.

Affected technology

Productivity Suite · 0 through SW V4.2.1.9
AutomationDirect

Productivity 3000 P3-622 CPU · 0 through SW V4.2.1.9
AutomationDirect

Productivity 3000 P3-550E CPU · 0 through SW V4.2.1.9
AutomationDirect

Productivity 3000 P3-530 CPU · 0 through SW v4.4.1.19
AutomationDirect

Productivity 2000 P2-622 CPU · 0 through SW v4.4.1.19
AutomationDirect

Productivity 2000 P2-550 CPU · 0 through SW v4.4.1.19
AutomationDirect

Productivity 1000 P1-550 CPU · 0 through SW v4.4.1.19
AutomationDirect

Productivity 1000 P1-540 CPU · 0 to before SW v4.4.1.19
AutomationDirect

Description’s affected range: version v4.4.1.19

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can interact with the ProductivityService PLC simulator and read, write, or delete arbitrary files and folders on the target machine. Vendor/CNA’s CVSS 4.0 assessment (base score 9.3/10) rates confidentiality, integrity and availability impact as high.

Published 18-Oct-2026 22:51 UTC

CWE: CWE-1327
CCR priority: 40.2 /100 (P3)
CVSS 3.1: 10.0 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · Vendor/CNA
EPSS: 0.00663 · percentile 0.5072 · 2026-10-17
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-18 22:50:08.248207+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-61934.html