CVE-2025-62688 AutomationDirect Productivity Suite Incorrect Permission Assignment for Critical Resource
Low-privileged attackers can escalate privileges to gain full control over the project in AutomationDirect Productivity Suite.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-62688?
CVE-2025-62688 is a medium-severity vulnerability in AutomationDirect Productivity 1000 P1-540 CPU, published on 23 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An incorrect permission assignment for a critical resource vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an attacker with low-privileged credentials to change their role, gaining full control access to the project.
Weakness: CWE-732
Which versions are affected by CVE-2025-62688?
How do I fix CVE-2025-62688?
No fix has been published for CVE-2025-62688 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-62688 being exploited?
There is no known exploitation of CVE-2025-62688 in the wild and no public exploit code.
Sources
Also known as GHSA-9p5f-59cx-3356.