CISA Emergency Alert: Critical RCE Flaw (CVSS 10.0) Exposes AutomationDirect PLCs to Unauthenticated Takeover

According to CISA, the alert warns of multiple high-severity vulnerabilities in AutomationDirect’s Productivity PLCs and the Productivity Suite engineering software, with one flaw rated CVSS 10.0 due to the potential for unauthenticated remote exploitation. The most severe issue, CVE-2025-61934, is a binding to an unrestricted IP address problem in the Productivity Suite simulator service that could let an unauthenticated attacker read, write or delete arbitrary files on the target machine.

The advisory notes that successful exploitation could enable arbitrary code execution, full-control access to projects, or read and write access to files, raising the risk of complete system compromise. AutomationDirect has released Productivity Suite version 4.5.0.x to address all nine identified vulnerabilities and urges users to update both software and firmware immediately.

For environments where patching is not possible, the guidance includes disconnecting PLCs from external networks, segmenting control networks, implementing strict firewall or NAC policies, and using VPNs only with up-to-date endpoints.