Cyber Posture

CVE-2025-61934

Critical

Published: 23 October 2025

Published
23 October 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0034 56.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may delete files left behind by the actions of their intrusion activity.

Security Summary

CVE-2025-61934 is a binding to an unrestricted IP address vulnerability (CWE-1327) discovered in Productivity Suite software version v4.4.1.19, specifically affecting the ProductivityService PLC simulator. Published on 2025-10-23T22:15:48.710, it carries a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity with network accessibility, low complexity, no privileges or user interaction required, and scope change.

An unauthenticated remote attacker can exploit this vulnerability over the network to interact directly with the ProductivityService PLC simulator, enabling read, write, or delete access to arbitrary files and folders on the target machine. This grants comprehensive file system manipulation, potentially leading to full system compromise, data exfiltration, persistence, or disruption of industrial control operations.

Mitigation details are outlined in related advisories, including CISA ICSA-25-296-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01 and https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json), AutomationDirect security considerations (https://support.automationdirect.com/docs/securityconsiderations.pdf), and software downloads (https://www.automationdirect.com/support/software-downloads). Practitioners should consult these for patching instructions and configuration guidance.

Details

CWE(s)
CWE-1327

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
attack.mitre.org →
Why these techniques?

The vulnerability in a public-facing ProductivityService allows unauthenticated remote arbitrary file read/write/delete, directly enabling initial access via public-facing app exploitation (T1190), local data collection (T1005), file discovery (T1083), and file deletion for evasion (T1070.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References