CVE-2025-58429: Productivity Suite Path Traversal Flaw

CVE-2025-58429 Overview

CVE-2025-58429 is a relative path traversal vulnerability [CWE-23] affecting AutomationDirect Productivity Suite version 4.4.1.19. The flaw resides in the ProductivityService PLC simulator component. An unauthenticated remote attacker can interact with the service and delete arbitrary files on the target machine by submitting crafted path inputs containing traversal sequences. The vulnerability is tracked in CISA ICS Advisory ICSA-25-296-01 and impacts operational technology environments where the Productivity Suite engineering software is deployed.

Critical Impact
Unauthenticated remote attackers can delete arbitrary files on systems running Productivity Suite 4.4.1.19, leading to engineering data loss, PLC project corruption, and potential disruption of industrial control workflows.

Affected Products

AutomationDirect Productivity Suite version 4.4.1.19
ProductivityService PLC simulator component
Engineering workstations running the affected Productivity Suite release

Discovery Timeline

2025-10-23 - CVE-2025-58429 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-58429

Vulnerability Analysis

The vulnerability stems from improper sanitization of file path inputs accepted by the ProductivityService PLC simulator. The service exposes a network-reachable interface that processes file path parameters without validating relative traversal sequences such as ../. Attackers can construct path strings that escape the intended working directory and reference files anywhere on the host file system that the service has permission to modify.

Because the service does not enforce authentication for the affected operation, exploitation requires only network access to the listening port. Successful exploitation results in arbitrary file deletion. In industrial environments this can remove PLC project files, configuration backups, audit logs, or operating system components required for the engineering workstation to function. The deletion primitive can also be chained with other weaknesses to support follow-on intrusion activity by removing forensic evidence.

Root Cause

The root cause is missing or insufficient canonicalization of user-supplied file path parameters in the ProductivityService simulator. The component resolves relative paths against a base directory without rejecting traversal tokens or verifying that the resolved path remains inside an allowlisted location. Classification as [CWE-23] (Relative Path Traversal) reflects that the attacker controls a relative path component used directly in a file system operation.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker reaches the ProductivityService listener over the network and issues a request containing a crafted file path with traversal sequences pointing at the target file. The service performs the delete operation under its own privileges. Refer to the CISA ICS Advisory ICSA-25-296-01 and the GitHub CSAF Resource for protocol-level details.

Detection Methods for CVE-2025-58429

Indicators of Compromise

Unexpected file deletions in directories used by Productivity Suite, including PLC project, configuration, and log folders.
Network connections to the ProductivityService PLC simulator listener originating from unexpected hosts or external addresses.
Request payloads to the simulator service containing relative path sequences such as ../ or encoded variants like %2e%2e%2f.
Application or service logs showing file operations targeting paths outside the simulator's working directory.

Detection Strategies

Monitor process and file system telemetry on engineering workstations for delete operations performed by the ProductivityService process against paths outside its install directory.
Inspect network traffic to the simulator listener and alert on requests containing path traversal patterns.
Correlate Productivity Suite service events with file system change events to identify deletion sequences initiated by external requests.

Monitoring Recommendations

Enable verbose logging on Productivity Suite hosts and forward logs to a centralized SIEM for retention and search.
Track inbound network flows to PLC simulator ports and baseline expected client addresses, alerting on deviations.
Establish file integrity monitoring on PLC project directories and configuration stores to detect unauthorized deletions in real time.

How to Mitigate CVE-2025-58429

Immediate Actions Required

Restrict network access to engineering workstations running Productivity Suite using firewall rules that permit only trusted operator and engineering hosts.
Disable or stop the ProductivityService PLC simulator on systems where it is not actively required.
Apply the latest Productivity Suite release available from the AutomationDirect Software Downloads page.
Review backups of PLC projects and configuration files to ensure recoverable copies exist offline.

Patch Information

AutomationDirect distributes updated Productivity Suite installers through the AutomationDirect Software Downloads portal. Operators should consult the AutomationDirect Security Considerations PDF and the CISA ICS Advisory ICSA-25-296-01 for the fixed version and deployment guidance specific to version 4.4.1.19.

Workarounds

Place engineering workstations behind an isolated OT network segment with no direct internet exposure, consistent with CISA ICS defense-in-depth guidance.
Block inbound connections to the PLC simulator port at the host firewall when the simulator is not in use.
Run Productivity Suite under a least-privileged user account so that file deletions are constrained to non-critical paths.
Require VPN or jump-host access for all remote engineering sessions touching Productivity Suite systems.

bash

# Example: restrict access to the ProductivityService listener on a Windows host
# Replace <PORT> with the simulator port and <TRUSTED_SUBNET> with the engineering subnet
netsh advfirewall firewall add rule name="Block ProductivityService External" \
  dir=in action=block protocol=TCP localport=<PORT>

netsh advfirewall firewall add rule name="Allow ProductivityService Engineering" \
  dir=in action=allow protocol=TCP localport=<PORT> remoteip=<TRUSTED_SUBNET>