CVE-2025-60023

MediumCVSS 4.0/10Last modified Oct 18, 2026

Description

A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary directories on the target machine.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-23

Affected software

VendorProductVersions
AutomationDirectProductivity Suite<= SW V4.2.1.9
AutomationDirectProductivity 3000 P3-622 CPU<= SW V4.2.1.9
AutomationDirectProductivity 3000 P3-550E CPU<= SW V4.2.1.9
AutomationDirectProductivity 3000 P3-530 CPU<= SW v4.4.1.19
AutomationDirectProductivity 2000 P2-622 CPU<= SW v4.4.1.19
AutomationDirectProductivity 2000 P2-550 CPU<= SW v4.4.1.19
AutomationDirectProductivity 1000 P1-550 CPU<= SW v4.4.1.19
AutomationDirectProductivity 1000 P1-540 CPU< SW v4.4.1.19

References

Timeline

Published
Oct 23, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-600248.8Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet CVE-2025-60035.3The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a fuCVE-2025-600358.8A vulnerability has been identified in the OPC.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are CVE-2025-600368.8A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are aCVE-2025-600378.8A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by paCVE-2025-600388.8A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by paCVE-2025-600399.8Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <=CVE-2025-60045.3Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault CCVE-2025-600406.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fkrauthan wp-mpdf wp-mpdf allows StoreCVE-2025-600418.8Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password RecoCVE-2025-600428.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes ChinchCVE-2025-600438.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Wander