IM
IronMonkey Threat Research
‹ Back to ICS Advisories

AutomationDirect Productivity Suite

HIGH
CVSS 7.0
Date 2026-07-16T06:00:00+00:00
Source cisa-csaf
Published by CISA

// Description

Successful exploitation of these vulnerabilities could allow an attacker with local or physical access to cause memory corruption, unintended information disclosure, application instability, or a denial-of-service condition in the affected product.

// Vulnerabilities (6)

CVE ID CVSS Score Severity Description
CVE-2026-61378 5.5 medium
A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.
CVE-2026-61389 7.0 high
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
CVE-2026-60063 7.0 high
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
CVE-2026-60140 6.1 medium
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable.
CVE-2026-60073 5.9 medium
An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory.
CVE-2026-57896 6.1 medium
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.

// Remediations (10)

Mitigation: Enable and regularly review system logs to detect suspicious or unauthorized activity.
Enable and regularly review system logs to detect suspicious or unauthorized activity.
Mitigation: Continuously evaluate risks associated with running outdated firmware and adjust compensating measur
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.
Mitigation: Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.
Mitigation: If the update cannot be applied right away, the following compensating controls are recommended unti
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.
Mitigation: Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN)
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.
Mitigation: Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.
Mitigation: AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
Mitigation: Restrict both physical and logical access to authorized personnel only.
Restrict both physical and logical access to authorized personnel only.
Mitigation: Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Use only trusted, dedicated internal networks or air-gapped systems for device communication.
Mitigation: Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.

// References