Description
An out-of-bounds read in the Productivity Suite allows a physical
attacker to control the length of data sent to a USB device. This can
lead to a system crash or disclosure of kernel memory.
Published: 2026-07-16
Score: 5.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An out‑of‑bounds read in AutomationDirect Productivity Suite allows a nearby attacker to dictate the length of data sent to a USB device. By manipulating this length the attacker can trigger a system crash or read unintended kernel memory, potentially compromising both availability and confidentiality.

Affected Systems

Vulnerable systems run AutomationDirect Productivity Suite; no specific version list is provided in the data, so any installation that has not been upgraded to v4.7.0.47 or later should be considered at risk.

Risk and Exploitability

The CVSS score of 5.2 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation. The issue is not listed in the CISA KEV catalog. The attack vector appears to be physical, requiring proximity to the affected workstation or device. If exploited, the flaw could lead to denial of service or the disclosure of kernel memory. The vendor recommends updating to v4.7.0.47 or later to eliminate the flaw.

Generated by OpenCVE AI on July 31, 2026 at 01:19 UTC.

Remediation

Vendor Solution

AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above  https://www.automationdirect.com/support/software-downloads

Vendor Workaround

If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed. * Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure. * Use only trusted, dedicated internal networks or air-gapped systems for device communication. * Restrict both physical and logical access to authorized personnel only. * Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software. * Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts. * Enable and regularly review system logs to detect suspicious or unauthorized activity. * Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident. * Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.

OpenCVE Recommended Actions

  • Install AutomationDirect Productivity Suite update v4.7.0.47 or newer
  • Disconnect the engineering workstation from external networks or place it on an air‑gapped system
  • Restrict both physical and logical access to authorized personnel only
  • Configure application whitelisting so that only trusted, pre‑approved software can run
  • Deploy antivirus or EDR tools and configure host‑based firewalls to block unauthorized access attempts
  • Enable and review system logs regularly to detect suspicious activity
  • Maintain secure, tested backups of the PLC and its configurations to minimize downtime

Generated by OpenCVE AI on July 31, 2026 at 01:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Automationdirect
Automationdirect productivity Suite
Vendors & Products Automationdirect
Automationdirect productivity Suite

Thu, 16 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory.
Title AutomationDirect Productivity Suite Out-of-bounds Read
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}

cvssV4_0

{'score': 5.2, 'vector': 'CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Automationdirect Productivity Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-07-17T13:15:30.223Z

Reserved: 2026-07-09T15:00:24.541Z

Link: CVE-2026-60073

cve-icon Vulnrichment

Updated: 2026-07-17T13:15:21.714Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T01:30:05Z

Weaknesses