CVE-2025-59776: Productivity Suite Path Traversal Flaw

CVE-2025-59776 Overview

CVE-2025-59776 is a relative path traversal vulnerability [CWE-23] affecting AutomationDirect Productivity Suite software version 4.4.1.19. The flaw resides in the ProductivityService PLC simulator component. An unauthenticated remote attacker can interact with the service over the network and create arbitrary directories on the target machine. The vulnerability was disclosed through CISA ICS Advisory icsa-25-296-01, indicating relevance to operational technology (OT) and industrial control system (ICS) environments where Productivity Suite is deployed for PLC programming and simulation.

Critical Impact
Unauthenticated remote attackers can create arbitrary directories on hosts running the Productivity Suite PLC simulator, enabling filesystem manipulation in engineering workstations used to program industrial controllers.

Affected Products

AutomationDirect Productivity Suite version 4.4.1.19
ProductivityService PLC simulator component
Engineering workstations running vulnerable Productivity Suite builds

Discovery Timeline

2025-10-23 - CVE CVE-2025-59776 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59776

Vulnerability Analysis

The vulnerability affects the ProductivityService component that ships with Productivity Suite 4.4.1.19. This service exposes a network-accessible interface used by the PLC simulator. The service accepts input that is used to construct filesystem paths without adequately validating relative path sequences such as ../. As a result, an attacker can traverse outside the intended working directory and cause the service to create directories at arbitrary locations on the host filesystem.

Because the service does not require authentication, exploitation only requires network reachability to the vulnerable host. The impact is limited to integrity of the filesystem — the vulnerability enables directory creation rather than arbitrary file write or code execution, which is consistent with the medium severity rating.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-23]. The ProductivityService accepts path input from network clients and passes it to directory creation logic without canonicalization or rejection of parent-directory sequences. Missing input validation on the path parameter allows relative traversal segments to escape the intended base directory.

Attack Vector

An unauthenticated attacker with network access to the host running Productivity Suite sends a crafted request to the ProductivityService PLC simulator endpoint. The request includes a path parameter containing relative traversal sequences. The service resolves the traversal and creates the specified directory on the target filesystem. See CISA ICS Advisory icsa-25-296-01 for technical details.

No verified proof-of-concept code is publicly available at time of publication. The vulnerability is described in prose in the CISA advisory and the associated CSAF disclosure document.

Detection Methods for CVE-2025-59776

Indicators of Compromise

Unexpected directories appearing on engineering workstations running Productivity Suite, particularly outside the installation directory or user project folders.
Inbound network connections to the ProductivityService port from unknown or non-engineering hosts.
Process activity from Productivity Suite binaries creating directories in system paths such as C:\Windows\, C:\ProgramData\, or user profile roots.

Detection Strategies

Monitor filesystem events for directory creation initiated by Productivity Suite processes outside expected project paths.
Inspect network traffic to the ProductivityService for requests containing ../ or encoded traversal sequences such as ..%2f and ..%5c.
Correlate authentication-free access to PLC simulator ports with directory creation events on the same host.

Monitoring Recommendations

Enable host-based file integrity monitoring on engineering workstations, focusing on directory creation events.
Log and alert on all inbound connections to Productivity Suite service ports from outside the engineering VLAN.
Review Windows Security and Sysmon Event ID 11 logs for file/directory creation by ProductivityService processes.

How to Mitigate CVE-2025-59776

Immediate Actions Required

Isolate hosts running Productivity Suite 4.4.1.19 on segmented OT networks with no direct exposure to enterprise or internet-facing zones.
Block inbound network access to the ProductivityService PLC simulator port from all sources except explicitly authorized engineering workstations.
Audit engineering workstations for unexpected directories and unauthorized changes to the filesystem.

Patch Information

AutomationDirect provides updated software through the AutomationDirect Software Downloads portal. Review the AutomationDirect Security Considerations document and CISA ICS Advisory icsa-25-296-01 for the fixed version and deployment guidance. Upgrade all instances of Productivity Suite from 4.4.1.19 to the vendor-supplied patched release.

Workarounds

Disable the ProductivityService PLC simulator when it is not actively required for development or testing.
Restrict network access to the simulator using host-based firewall rules that permit only trusted engineering IP addresses.
Follow ISA/IEC 62443 network segmentation guidance to place engineering workstations in a dedicated zone behind an OT firewall.
Run Productivity Suite under a least-privileged Windows user account to limit the filesystem locations where directory creation succeeds.

bash

# Configuration example - Windows firewall rule restricting ProductivityService access
netsh advfirewall firewall add rule ^
  name="Restrict ProductivityService" ^
  dir=in ^
  action=block ^
  program="C:\Program Files (x86)\AutomationDirect\Productivity Suite\ProductivityService.exe" ^
  enable=yes

# Allow only a specific engineering workstation
netsh advfirewall firewall add rule ^
  name="Allow ProductivityService from Engineering" ^
  dir=in ^
  action=allow ^
  program="C:\Program Files (x86)\AutomationDirect\Productivity Suite\ProductivityService.exe" ^
  remoteip=10.10.20.0/24 ^
  enable=yes