CVE-2025-61977: Productivity Suite Auth Bypass Vulnerability

CVE-2025-61977 Overview

CVE-2025-61977 is a weak password recovery vulnerability affecting AutomationDirect Productivity Suite software version v4.4.1.19. The flaw allows an attacker to decrypt an encrypted project by correctly answering only a single recovery question, bypassing the intended multi-factor recovery workflow. The issue is tracked under CWE-640: Weak Password Recovery Mechanism for Forgotten Password and is documented in CISA ICS Advisory ICSA-25-296-01. Successful exploitation exposes intellectual property, control logic, and configuration data embedded within encrypted engineering projects used in industrial control system (ICS) environments.

Critical Impact
An attacker with local access to an encrypted Productivity Suite project can decrypt it by answering just one recovery question, exposing proprietary ICS logic and configuration.

Affected Products

AutomationDirect Productivity Suite software version v4.4.1.19
Encrypted project files produced by the affected Productivity Suite version
Engineering workstations running the vulnerable Productivity Suite installation

Discovery Timeline

2025-10-23 - CVE-2025-61977 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61977

Vulnerability Analysis

The vulnerability resides in the password recovery workflow used to unlock encrypted Productivity Suite projects. The recovery mechanism relies on knowledge-based questions to gate access to the decryption process. Instead of requiring the correct answer to multiple questions or an out-of-band factor, the implementation accepts a single correct answer as sufficient proof of ownership. This design weakness collapses the recovery entropy to whatever a single question can provide.

Recovery questions typically draw from a small answer space and often use personal details that can be enumerated through open-source intelligence or guessing. Once the recovery challenge is satisfied, the software proceeds to decrypt the project without further authentication checks. The impact extends beyond password reset semantics because the flaw directly yields access to decrypted engineering artifacts.

Root Cause

The root cause is an insufficient recovery challenge design classified as [CWE-640]. The application treats a single recovery answer as equivalent authentication to the original project password. There is no rate limiting, no layered verification, and no cryptographic binding of the recovery answer to a strong secret. As a result, the effective security of the encrypted project drops to the strength of the weakest recovery question.

Attack Vector

The attack vector is local. An adversary must possess a copy of the encrypted project file and access to the Productivity Suite software. The attacker launches the recovery workflow, is prompted with recovery questions, and supplies a guessed or researched answer to a single question. Upon acceptance, the software decrypts the project, exposing ladder logic, tag databases, communication settings, and other proprietary content. Insider threats and adversaries who exfiltrate project files from engineering workstations or backups are the primary threat actors.

No verified public exploit code is available. See the CISA ICS Advisory ICSA-25-296-01 and the CSAF advisory document for vendor-coordinated technical details.

Detection Methods for CVE-2025-61977

Indicators of Compromise

Unexpected access to Productivity Suite project files (.adpro and related artifacts) on engineering workstations or file shares.
Repeated launches of the Productivity Suite password recovery dialog logged by endpoint telemetry.
Copies of encrypted project files appearing on removable media, cloud storage, or personal devices.

Detection Strategies

Monitor process execution of the Productivity Suite binary and correlate with file reads against encrypted project directories.
Alert on off-hours or non-engineer accounts opening Productivity Suite projects on ICS engineering hosts.
Track outbound transfers of .adpro project files from segmented OT networks to IT or external destinations.

Monitoring Recommendations

Enable file integrity monitoring on directories that store Productivity Suite project files and recovery configuration data.
Ingest engineering workstation logs into a centralized SIEM or data lake and retain them for insider-threat investigations.
Review Windows security event logs for interactive logons to engineering workstations by unexpected users or service accounts.

How to Mitigate CVE-2025-61977

Immediate Actions Required

Inventory all systems running Productivity Suite v4.4.1.19 and prioritize them for update or isolation.
Restrict physical and logical access to engineering workstations that store encrypted project files.
Rotate any credentials, control logic secrets, or communication keys that may have been exposed in shared project files.
Move project files off shared drives and into access-controlled repositories with auditing enabled.

Patch Information

AutomationDirect publishes updated Productivity Suite installers on the Automation Direct Software Downloads portal. Review the Automation Direct Security Considerations document and CISA ICS Advisory ICSA-25-296-01 for the current fixed version and vendor guidance. Apply the vendor-supplied update on all engineering workstations and rebuild affected project files under the patched software.

Workarounds

Do not configure or rely on the built-in recovery questions; treat the project password as the sole authoritative secret and store it in an enterprise password manager.
Segment engineering workstations from business networks per ISA/IEC 62443 zones and conduits guidance.
Enforce full-disk encryption and strong logon controls on any workstation that stores Productivity Suite projects.
Maintain offline, access-controlled backups of project files so that a compromised copy can be identified and revoked.

bash

# Configuration example: restrict access to Productivity Suite project directories on Windows
# Remove inherited permissions and grant access only to authorized engineering group
icacls "C:\ProductivitySuite\Projects" /inheritance:r
icacls "C:\ProductivitySuite\Projects" /grant:r "DOMAIN\ICS-Engineers:(OI)(CI)M"
icacls "C:\ProductivitySuite\Projects" /grant:r "SYSTEM:(OI)(CI)F"
icacls "C:\ProductivitySuite\Projects" /grant:r "Administrators:(OI)(CI)F"

# Enable auditing on the project directory
auditpol /set /subcategory:"File System" /success:enable /failure:enable