CVE-2025-60023: Productivity Suite Path Traversal Flaw

CVE-2025-60023 Overview

CVE-2025-60023 is a relative path traversal vulnerability [CWE-23] affecting AutomationDirect Productivity Suite software version 4.4.1.19. The flaw resides in the ProductivityService component, which exposes a Programmable Logic Controller (PLC) simulator to network clients. An unauthenticated remote attacker can send crafted requests to the service and delete arbitrary directories on the host operating system. The vulnerability was published to the National Vulnerability Database (NVD) on October 23, 2025 and is tracked by CISA in advisory ICSA-25-296-01.

Critical Impact
Unauthenticated network attackers can traverse the filesystem through the ProductivityService PLC simulator and delete arbitrary directories, causing loss of engineering data and operational disruption in industrial control system (ICS) environments.

Affected Products

AutomationDirect Productivity Suite version 4.4.1.19
ProductivityService PLC simulator component
Engineering workstations running the affected Productivity Suite installation

Discovery Timeline

2025-10-23 - CVE-2025-60023 published to NVD and CISA advisory ICSA-25-296-01 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60023

Vulnerability Analysis

The vulnerability originates in the ProductivityService process, which listens on the network to serve requests for the PLC simulator bundled with Productivity Suite. The service accepts file or directory path parameters from clients without properly canonicalizing or validating them. As a result, an attacker can supply sequences such as ..\ or ../ to escape the intended working directory and reach arbitrary locations on the host.

The operation triggered by the malicious input is a directory delete, not a read or write. Successful exploitation removes directories outside the application's scope. In an industrial environment, deleted directories may include project files, historian data, configuration folders, or operating system components required for engineering workflows.

Exploitation requires no authentication and no user interaction. The attack originates over the network against the exposed service port on the engineering workstation.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-23] Relative Path Traversal. The ProductivityService accepts a client-controlled path and passes it to a directory deletion routine without enforcing a base directory boundary or rejecting relative traversal tokens.

Attack Vector

The attack vector is network-based. An attacker reachable on the same network segment as the engineering workstation connects to the ProductivityService endpoint and issues a request containing a path with relative traversal sequences. The service resolves the path against its working directory and invokes a delete operation on the resulting location.

Because the service is unauthenticated and exposed on the workstation, any host that can route packets to the listening port can trigger the vulnerability. See the CISA ICS Advisory ICSA-25-296-01 for the official technical description.

Detection Methods for CVE-2025-60023

Indicators of Compromise

Unexpected deletion of directories on hosts running Productivity Suite 4.4.1.19, particularly outside the installation directory.
Inbound network connections to the ProductivityService listening port from unauthorized or unknown source hosts.
Application or Windows event log entries showing the ProductivityService process performing filesystem operations on non-project paths.

Detection Strategies

Monitor process activity for ProductivityService invoking directory removal APIs such as RemoveDirectoryW or recursive delete calls targeting paths containing .. sequences.
Deploy network intrusion detection signatures for traffic to the ProductivityService port containing relative path traversal patterns like ..\, ../, or URL-encoded equivalents.
Correlate filesystem deletion events with parent process telemetry to identify anomalous mass-deletion behavior originating from the simulator service.

Monitoring Recommendations

Enable file integrity monitoring on the Productivity Suite installation directory and adjacent engineering data folders.
Log and alert on all inbound connections to engineering workstations from hosts outside the defined ICS management VLAN.
Track process command lines and network sockets for ProductivityService to establish a baseline and detect deviations.

How to Mitigate CVE-2025-60023

Immediate Actions Required

Inventory all hosts running Productivity Suite 4.4.1.19 and identify systems exposing the ProductivityService port to the network.
Restrict network access to engineering workstations using host firewalls and network segmentation so only authorized engineering hosts can reach the service.
Apply the vendor patch as soon as it is available from the AutomationDirect Software Downloads portal.

Patch Information

AutomationDirect publishes updated Productivity Suite releases through its software downloads page. Refer to the CISA ICS Advisory ICSA-25-296-01 and the AutomationDirect Security Considerations document for the fixed version and deployment guidance. Upgrade all installations of 4.4.1.19 to the fixed release.

Workarounds

Block inbound traffic to the ProductivityService listener at the host firewall on all engineering workstations that do not require remote simulator access.
Isolate engineering workstations on a dedicated ICS network segment following the defense-in-depth guidance in the AutomationDirect Security Considerations document.
Disable or stop the PLC simulator service when it is not actively required for development work.

bash

# Windows firewall example: block inbound traffic to ProductivityService
# Replace <PORT> with the ProductivityService listener port identified on the host
netsh advfirewall firewall add rule ^
  name="Block ProductivityService Inbound (CVE-2025-60023)" ^
  dir=in ^
  action=block ^
  protocol=TCP ^
  localport=<PORT>