CVE-2025-61934
BaseFortify
Publication date: 2025-10-23
Last updated on: 2025-10-27
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| automationdirect | productivity_3000 | * |
| automationdirect | productivity_suite | * |
| automationdirect | productivity_2000 | * |
| automationdirect | productivity_1000 | * |
| automationdirect | productivity_suite | 4.4.1.19 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1327 | The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Productivity Suite software version v4.4.1.19, where a binding to an unrestricted IP address allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator. The attacker can read, write, or delete arbitrary files and folders on the target machine.
How can this vulnerability impact me? :
The vulnerability can have a severe impact as it allows an unauthenticated remote attacker to gain unauthorized access to the system, potentially leading to data loss, data manipulation, or system compromise by reading, writing, or deleting arbitrary files and folders.