AutomationDirect Productivity Suite Relative Path Traversal Vulnerability Allowing Arbitrary File Writing

A relative path traversal vulnerability has been identified in AutomationDirect Productivity Suite version 4.4.1.19 and prior. This vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and write files with arbitrary data on the target machine.

Impact

Exploitation of this vulnerability could enable an attacker to execute arbitrary code on the machine where the affected project is opened.

Remediation

Users are advised to update the Productivity Suite programming software to version 4.5.0.x or higher. For instances where systems cannot be upgraded, AutomationDirect recommends physically disconnecting the PLC from any external networks, configuring network segmentation to isolate the PLC from other devices, and implementing firewall rules or network access control policies to block traffic to the PLC.