AutomationDirect Productivity Suite Relative Path Traversal Vulnerability

A relative path traversal vulnerability has been identified in AutomationDirect Productivity Suite version 4.4.1.19 and prior. This vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read arbitrary files on the target machine.

Impact

Exploitation of this vulnerability could enable an attacker to read arbitrary files on the affected machine, potentially leading to unauthorized information disclosure.

Remediation

Users are advised to update the Productivity Suite programming software to version 4.5.0.x or higher. For instances where systems cannot be upgraded, AutomationDirect recommends physically disconnecting the PLC from any external networks, configuring network segmentation to isolate the PLC from other devices and systems, and implementing firewall rules or network access control policies to block incoming and outgoing traffic to the PLC. Additional information can be found in AutomationDirect's security considerations document.