AutomationDirect Productivity Suite Weak Password Recovery Mechanism for Forgotten Password
Priority LOW 33CWE-640Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-640.
Summary
A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an attacker to decrypt an encrypted project by answering just one recovery question.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00142 3rd percentileScored 2026-11-07
Fix Fixed Productivity 1000 P1-540 CPU (AutomationDirect): SW v4.4.1.19
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AutomationDirect | Productivity Suite | up to SW V4.2.1.9 | — | No fix listed | CNA |
| AutomationDirect | Productivity 3000 P3-622 CPU | up to SW V4.2.1.9 | — | No fix listed | CNA |
| AutomationDirect | Productivity 3000 P3-550E CPU | up to SW V4.2.1.9 | — | No fix listed | CNA |
| AutomationDirect | Productivity 3000 P3-530 CPU | up to SW v4.4.1.19 | — | No fix listed | CNA |
| AutomationDirect | Productivity 2000 P2-622 CPU | up to SW v4.4.1.19 | — | No fix listed | CNA |
| AutomationDirect | Productivity 2000 P2-550 CPU | up to SW v4.4.1.19 | — | No fix listed | CNA |
| AutomationDirect | Productivity 1000 P1-550 CPU | up to SW v4.4.1.19 | — | No fix listed | CNA |
| AutomationDirect | Productivity 1000 P1-540 CPU | before SW v4.4.1.19 | SW v4.4.1.19 | Patch available | CNA |
- Productivity Suite VendorAutomationDirect Affected up to SW V4.2.1.9 Fixed in — No fix listed CNA
- Productivity 3000 P3-622 CPU VendorAutomationDirect Affected up to SW V4.2.1.9 Fixed in — No fix listed CNA
- Productivity 3000 P3-550E CPU VendorAutomationDirect Affected up to SW V4.2.1.9 Fixed in — No fix listed CNA
- Productivity 3000 P3-530 CPU VendorAutomationDirect Affected up to SW v4.4.1.19 Fixed in — No fix listed CNA
- Productivity 2000 P2-622 CPU VendorAutomationDirect Affected up to SW v4.4.1.19 Fixed in — No fix listed CNA
- Productivity 2000 P2-550 CPU VendorAutomationDirect Affected up to SW v4.4.1.19 Fixed in — No fix listed CNA
- Productivity 1000 P1-550 CPU VendorAutomationDirect Affected up to SW v4.4.1.19 Fixed in — No fix listed CNA
- Productivity 1000 P1-540 CPU VendorAutomationDirect Affected before SW v4.4.1.19 Fixed in SW v4.4.1.19 Patch available CNA
Remediation
- Fix · CNA Productivity 1000 P1-540 CPU (AutomationDirect) Fixed in SW v4.4.1.19
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
AutomationDirect Productivity 1000 P1-540 CPU SW v4.4.1.19
9 records Highest priority Priority MEDIUM 2 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2025-38283 AutomationDirect Productivity Suite Binding to an Unrestricted IP Address CWE-1327Priority MEDIUM 49
- TI-2025-38740 AutomationDirect Productivity Suite Relative Path TraversalPriority MEDIUM 40
- TI-2025-36214 AutomationDirect Productivity Suite Relative Path TraversalPriority LOW 37
Timeline
- 2026-10-02 Threatist record created from CVE-2025-61977
- 2026-10-03 Alias added: GHSA-2fv7-mv57-whf5
References
More AutomationDirect vulnerabilities
- TI-2024-14467 A leftover debug code vulnerability exists in the Telnet Diagnostic Interface… CVSS 3.1CRITICAL 9.8
- TI-2024-14780 Improper access control in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.1
- TI-2025-24868 AutomationDirect MB-Gateway Missing Authentication for Critical Function CVSS 4.0CRITICAL 10.0
- TI-2024-16461 Stack-based buffer overflow in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.8
- TI-2024-16460 Stack-based buffer overflow in AutomationDirect P3-550E CVSS 3.1CRITICAL 9.8
- TI-2021-12594 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-61977 · CVE Program
- CVE-2025-61977 · NVD
- FIRST EPSS
- GHSA-2fv7-mv57-whf5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences