CVE-2025-61934
Published: 23 October 2025
Summary
CVE-2025-61934 is a critical-severity Binding to an Unrestricted IP Address (CWE-1327) vulnerability in Automationdirect (inferred from references). Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SC-7 (Boundary Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific binding vulnerability in ProductivityService PLC simulator through flaw identification, patching, and timely updates as recommended in advisories.
Prevents unauthenticated remote exploitation by monitoring and controlling network communications at external boundaries to block access to the vulnerable service.
Mitigates unrestricted IP binding by enforcing secure configuration settings that restrict the PLC simulator to loopback or authorized interfaces only.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability in a public-facing ProductivityService allows unauthenticated remote arbitrary file read/write/delete, directly enabling initial access via public-facing app exploitation (T1190), local data collection (T1005), file discovery (T1083), and file deletion for evasion (T1070.004).
NVD Description
A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read, write, or delete arbitrary files and folders on…
more
the target machine
Deeper analysisAI
CVE-2025-61934 is a binding to an unrestricted IP address vulnerability (CWE-1327) discovered in Productivity Suite software version v4.4.1.19, specifically affecting the ProductivityService PLC simulator. Published on 2025-10-23T22:15:48.710, it carries a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity with network accessibility, low complexity, no privileges or user interaction required, and scope change.
An unauthenticated remote attacker can exploit this vulnerability over the network to interact directly with the ProductivityService PLC simulator, enabling read, write, or delete access to arbitrary files and folders on the target machine. This grants comprehensive file system manipulation, potentially leading to full system compromise, data exfiltration, persistence, or disruption of industrial control operations.
Mitigation details are outlined in related advisories, including CISA ICSA-25-296-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01 and https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json), AutomationDirect security considerations (https://support.automationdirect.com/docs/securityconsiderations.pdf), and software downloads (https://www.automationdirect.com/support/software-downloads). Practitioners should consult these for patching instructions and configuration guidance.
Details
- CWE(s)