Description
An incorrect permission assignment for a critical resource vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an attacker with low-privileged credentials to change their role, gaining full control access to the project.
References (4)
Core 4
Core References
Various Sources
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json
Various Sources
https://www.automationdirect.com/support/software-downloads
Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01
Scores
CVSS v3
7.1
EPSS
0.0013
EPSS Percentile
2.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-732
Status
published
Products (8)
AutomationDirect/Productivity 1000 P1-540 CPU
< SW v4.4.1.19
AutomationDirect/Productivity 1000 P1-550 CPU
< SW v4.4.1.19
AutomationDirect/Productivity 2000 P2-550 CPU
< SW v4.4.1.19
AutomationDirect/Productivity 2000 P2-622 CPU
< SW v4.4.1.19
AutomationDirect/Productivity 3000 P3-530 CPU
< SW v4.4.1.19
AutomationDirect/Productivity 3000 P3-550E CPU
< SW V4.2.1.9
AutomationDirect/Productivity 3000 P3-622 CPU
< SW V4.2.1.9
AutomationDirect/Productivity Suite
< SW V4.2.1.9
Published
Oct 23, 2025
Tracked Since
Feb 18, 2026