CVE-2025-62498 AutomationDirect CVE debrief

Who should care

OT and ICS operators, automation engineers, plant floor support teams, and IT security teams responsible for engineering workstations or systems that open Productivity Suite project files. Organizations running Productivity Suite 4.4.1.19, or using connected AutomationDirect PLC environments, should prioritize review if project files may be shared from less-trusted sources.

Technical summary

CISA describes the issue as a relative path traversal (ZipSlip) vulnerability in Productivity Suite 4.4.1.19. In practical terms, a crafted or tampered project archive can cause files to be written outside the intended extraction path, which can then lead to arbitrary code execution when the project is opened. The advisory lists affected Product families and recommends upgrading the programming software to 4.5.0.x or later, along with standard OT segmentation and isolation controls.

Defensive priority

High. The CVSS score is 8.8 and the impact includes code execution on the engineering machine that opens a malicious project. Treat as a priority for any environment where project files can arrive from vendors, contractors, removable media, email, or shared file systems.

Recommended defensive actions

• Upgrade Productivity Suite programming software to version 4.5.0.x or higher.
• Apply the latest firmware updates for Productivity PLCs using AutomationDirect’s software download resources.
• Restrict project-file handling to trusted sources and review workflows that import, exchange, or archive Productivity Suite projects.
• Segment OT networks so engineering workstations and PLCs are isolated from broader IT networks and untrusted systems.
• Use firewall or NAC controls to block unnecessary inbound and outbound traffic to PLC-related assets.
• If upgrading is not immediately possible, physically disconnect exposed PLCs from external networks where feasible.
• Follow AutomationDirect’s security considerations and CISA recommended practices for industrial control systems.

Evidence notes

All substantive claims are drawn from the supplied CISA CSAF advisory item and its listed remediations. The corpus identifies the affected version as Productivity Suite 4.4.1.19, the vulnerability class as ZipSlip relative path traversal, the potential impact as arbitrary code execution when a tampered project is opened, and the fixed software baseline as Productivity Suite 4.5.0.x or higher. Published and modified dates supplied in the corpus are both 2025-10-23T06:00:00.000Z; no separate KEV entry is present in the supplied enrichment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.