CVE-2025-58078 Overview
CVE-2025-58078 is a relative path traversal vulnerability [CWE-23] affecting AutomationDirect Productivity Suite software version 4.4.1.19. The flaw resides in the ProductivityService PLC simulator component. An unauthenticated remote attacker can interact with the service over the network and write files containing arbitrary data to the target machine. The vulnerability impacts operational technology (OT) environments where the Productivity Suite is deployed for programmable logic controller (PLC) programming and simulation. CISA published advisory ICSA-25-296-01 detailing the issue.
Critical Impact
Unauthenticated remote attackers can write arbitrary files to engineering workstations running Productivity Suite, enabling code drop, configuration tampering, or follow-on compromise of industrial control systems.
Affected Products
- AutomationDirect Productivity Suite version 4.4.1.19
- ProductivityService PLC simulator component
- Engineering workstations running the affected Productivity Suite build
Discovery Timeline
- 2025-10-23 - CVE-2025-58078 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-58078
Vulnerability Analysis
The vulnerability is a relative path traversal flaw [CWE-23] in the ProductivityService component that ships with the AutomationDirect Productivity Suite PLC simulator. The service exposes functionality over the network without authentication and does not properly canonicalize or validate file path input supplied by remote clients. Attackers can submit crafted relative path sequences such as ..\ to escape the intended write directory and place files at arbitrary locations on the host filesystem.
Because the attack vector is the network and no authentication or user interaction is required, exploitation can be fully automated. The impact targets file integrity and availability on the engineering workstation. Writing files into startup directories, service binaries, or PLC project folders can lead to code execution on the host or tampering of control logic deployed to downstream PLCs.
Root Cause
The ProductivityService accepts file write operations from remote clients and constructs destination paths by concatenating attacker-controlled input with a base directory. The service fails to reject path components containing .. traversal sequences or absolute path overrides, allowing the resulting path to resolve outside the intended directory.
Attack Vector
Exploitation requires network reachability to the host running the Productivity Suite simulator. The attacker sends a crafted request to the ProductivityService endpoint that includes a relative path traversal payload and arbitrary file contents. The service writes the file to the resolved location with the privileges of the running process. No credentials, prior access, or user interaction is required.
No verified public proof-of-concept code is available. See the CISA ICS Advisory ICSA-25-296-01 for additional technical context.
Detection Methods for CVE-2025-58078
Indicators of Compromise
- Unexpected files appearing outside the Productivity Suite installation or project directories, particularly in system startup paths or service binary locations.
- Inbound network connections to the ProductivityService listener from untrusted hosts or external networks.
- Modifications to PLC project files, configuration files, or executables on engineering workstations without a corresponding change ticket.
Detection Strategies
- Monitor filesystem activity on engineering workstations for write operations originating from the ProductivityService process targeting paths outside its expected working directory.
- Inspect network traffic to the Productivity Suite host for request payloads containing ..\, ../, or encoded traversal sequences.
- Baseline the normal set of files written by the simulator and alert on deviations, particularly files with executable extensions or in user profile directories.
Monitoring Recommendations
- Enable host-based logging of file creation events on systems running Productivity Suite and forward them to a centralized SIEM for correlation.
- Apply network segmentation monitoring to detect any external or cross-zone access attempts to OT engineering workstations.
- Review the AutomationDirect Security Considerations document for vendor-recommended logging configurations.
How to Mitigate CVE-2025-58078
Immediate Actions Required
- Identify all hosts running Productivity Suite version 4.4.1.19 and isolate them from untrusted networks until patched.
- Block inbound network access to the ProductivityService listener at the host firewall and at network boundary devices.
- Restrict use of the PLC simulator to dedicated engineering workstations placed inside a segmented OT network zone.
Patch Information
Updated software is available from the vendor. Download the latest Productivity Suite release from the AutomationDirect Software Downloads page and apply it to all affected engineering workstations. Refer to the CISA ICS Advisory ICSA-25-296-01 and the GitHub CSAF File for the authoritative fixed version list.
Workarounds
- Disable or uninstall the ProductivityService PLC simulator on hosts that do not require simulation functionality.
- Enforce strict network segmentation following ISA/IEC 62443 zones and conduits between IT and OT networks.
- Place engineering workstations behind a firewall and require VPN access with multi-factor authentication for any remote engineering sessions.
- Apply the host hardening guidance in the AutomationDirect Security Considerations document.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
