CVE-2025-58456 Overview
CVE-2025-58456 is a relative path traversal vulnerability [CWE-23] affecting AutomationDirect Productivity Suite version 4.4.1.19. The flaw resides in the ProductivityService programmable logic controller (PLC) simulator component. An unauthenticated remote attacker can interact with the service and read arbitrary files on the target machine.
The vulnerability was disclosed through CISA ICS Advisory ICSA-25-296-01 and affects operational technology (OT) environments running the affected engineering software. Successful exploitation exposes sensitive files that may include configuration data, credentials, and proprietary PLC project files.
Critical Impact
Unauthenticated remote attackers can read arbitrary files from systems running Productivity Suite 4.4.1.19, enabling information disclosure that can facilitate further compromise of industrial control environments.
Affected Products
- AutomationDirect Productivity Suite version 4.4.1.19
- ProductivityService PLC simulator component
- Engineering workstations running the affected software in OT environments
Discovery Timeline
- 2025-10-23 - CVE-2025-58456 published to the National Vulnerability Database (NVD)
- 2025-10-23 - CISA released ICS Advisory ICSA-25-296-01
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-58456
Vulnerability Analysis
The vulnerability stems from insufficient validation of file path input handled by the ProductivityService PLC simulator. The service exposes functionality over the network without requiring authentication. An attacker supplies crafted relative path sequences that traverse outside the intended directory to reach arbitrary files on the host operating system.
Because the affected component is a PLC simulator, it typically runs on engineering workstations used to develop and test ladder logic. These systems often store PLC project files, network diagrams, and credential material relevant to industrial operations. File disclosure at this layer provides attackers with reconnaissance data to pivot deeper into OT networks.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-23] Relative Path Traversal. The service accepts user-controlled path components and concatenates them with a base directory without canonicalizing the result or rejecting .. sequences. This allows the file read routine to resolve paths outside the intended scope.
Attack Vector
Exploitation requires network access to the ProductivityService endpoint. The attacker sends a request containing a relative path with directory traversal sequences targeting a file of interest. No credentials, user interaction, or prior foothold are required. The CVSS v4.0 vector reflects a network-reachable, low-complexity attack that impacts confidentiality of the vulnerable component and subsequent systems.
No verified public exploit code is currently available. Detailed technical information is available in the CISA ICS Advisory ICSA-25-296-01 and the GitHub CSAF JSON Document.
Detection Methods for CVE-2025-58456
Indicators of Compromise
- Network requests to the ProductivityService simulator containing path traversal sequences such as ../, ..\, or URL-encoded variants like %2e%2e%2f
- Unexpected read access to system files such as C:\Windows\win.ini, C:\Windows\System32\drivers\etc\hosts, or PLC project directories
- Connections to the ProductivityService port from hosts outside the engineering workstation subnet
Detection Strategies
- Inspect network traffic destined to engineering workstations for traversal patterns in service requests
- Enable process and file access auditing on the ProductivityService executable to identify reads outside its working directory
- Correlate outbound file reads with process ancestry to flag ProductivityService accessing sensitive system paths
Monitoring Recommendations
- Baseline expected network peers of Productivity Suite engineering workstations and alert on new external sources
- Forward Windows Security and Sysmon events from OT engineering hosts to a centralized data lake for retrospective hunting
- Monitor for the creation of unusual outbound sessions from the engineering workstation immediately following inbound simulator traffic
How to Mitigate CVE-2025-58456
Immediate Actions Required
- Restrict network access to systems running Productivity Suite so only authorized engineering hosts can reach the ProductivityService port
- Do not expose the PLC simulator directly to the internet or to enterprise IT networks
- Audit engineering workstations for the affected version 4.4.1.19 and prioritize remediation
Patch Information
AutomationDirect publishes updated releases through its Software Downloads portal. Review the vendor's Security Considerations documentation and apply the fixed version identified in CISA ICS Advisory ICSA-25-296-01.
Workarounds
- Place engineering workstations behind a firewall and permit inbound simulator traffic only from trusted management hosts
- Disable the ProductivityService PLC simulator when it is not actively required for development or testing
- Segment OT networks per ISA/IEC 62443 zone-and-conduit guidance to limit lateral reach to engineering assets
- Enforce least privilege on the account running the simulator so accessible files exclude sensitive system content
# Example: Windows Defender Firewall rule to restrict ProductivityService access
# Replace <TRUSTED_IP> with the authorized engineering workstation address
netsh advfirewall firewall add rule name="Restrict ProductivityService" ^
dir=in action=block program="C:\Program Files (x86)\AutomationDirect\ProductivitySuite\ProductivityService.exe" ^
enable=yes
netsh advfirewall firewall add rule name="Allow ProductivityService Trusted" ^
dir=in action=allow program="C:\Program Files (x86)\AutomationDirect\ProductivitySuite\ProductivityService.exe" ^
remoteip=<TRUSTED_IP> enable=yes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
