CVE-2025-61934CWE-1327

CVE-2025-61934

Critical · published October 24, 2025

CVSS v3.1
10.0
EPSS
1%
Percentile
51.2
In the wild
Unconfirmed
What it is

🚨 A flaw in Productivity Suite version 4.4.1.19 lets attackers waltz right in through an unrestricted IP address, unlocking the door to all files on the server! 🔥 Think of it like a restaurant where anyone can walk in and access the kitchen without any checks. They could steal recipes, change orders, or even mess with the food before it’s served! An attacker could read, write, or delete any file or folder on the target machine, essentially taking control of your system! This could lead to data loss, disruption of services, or even sensitive information leaks, compounding the risk of a major security breach.

Put simply

Think of it like a restaurant where anyone can walk in and access the kitchen without any checks. They could steal recipes, change orders, or even mess with the food before it’s served! This vulnerability stems from a binding to an unrestricted IP address in the ProductivityService PLC simulator, allowing unauthenticated users unrestricted access to the file system commands.

What to do

An attacker could read, write, or delete any file or folder on the target machine, essentially taking control of your system! This could lead to data loss, disruption of services, or even sensitive information leaks, compounding the risk of a major security breach. To mitigate this risk, upgrade to the latest version of the Productivity Suite immediately. Additionally, implement strict IP whitelisting to ensure only trusted addresses can interact with the service. You've got this! Fixing this vulnerability will safeguard your systems and keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00663 · 51.2th percentile
Weakness
CWE-1327 · Binding to an Unrestricted IP Address
Published
2025-10-24T02:15Z
References (4)
EPSS history
Timeline
  • 23 OCT 22:01Z
    AutomationDirect Productivity Suite Binding to an Unrestricted IP Address CWE-1327
    cvelistv5