CVE-2025-61934

CriticalCVSS 10.0/10Last modified Oct 18, 2026

Description

A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read, write, or delete arbitrary files and folders on the target machine

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1327

Affected software

No affected versions have been published.

Timeline

Published: Oct 23, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-619357.5When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to termin CVE-2025-6193710.0The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “CVE-2025-619387.5When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protect CVE-2025-619394.4An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attack CVE-2025-619408.8NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client CVE-2025-619418.6A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10. Arbitrary file may be altered by an administrative CVE-2025-619437.8The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Capt CVE-2025-619448.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-619459.8Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once ins CVE-2025-619494.8LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitra CVE-2025-61954.3GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that CVE-2025-619505.3In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. W