AutomationDirect Productivity Suite: Six Memory Corruption Flaws Disclosed Together
Six vulnerabilities in AutomationDirect Productivity Suite, disclosed on July 16, 2026, present risks of memory corruption, system crashes, and privilege escalation.
Key findings
- Six vulnerabilities in AutomationDirect Productivity Suite disclosed on July 16, 2026, primarily involve memory corruption.
- Flaws include out-of-bounds reads/writes and a divide-by-zero error, allowing local or physical attackers to cause crashes or escalate privileges.
- CISA warns of potential memory corruption, information disclosure, instability, and denial-of-service conditions.
- Affected versions are Productivity Suite <= v4.6.2.2; patched in v4.6.2.2.
On July 16, 2026, a batch of six vulnerabilities was disclosed for AutomationDirect's Productivity Suite. These vulnerabilities, all disclosed simultaneously, primarily involve memory corruption issues stemming from out-of-bounds reads and writes, as well as a divide-by-zero flaw. Successful exploitation could lead to system crashes, information disclosure, or privilege escalation, posing a significant risk to industrial control systems.
The disclosed vulnerabilities can be grouped by their impact and attack vector. Four of the CVEs (CVE-2026-60063, CVE-2026-61389, CVE-2026-57896, and CVE-2026-60140) are related to out-of-bounds read or write vulnerabilities. These flaws allow a local attacker to trigger kernel memory corruption via crafted IOCTL requests, potentially leading to privilege escalation or system instability. CVE-2026-60073, another out-of-bounds read vulnerability, specifically affects the data length sent to a USB device, which could result in a system crash or disclosure of kernel memory, and requires physical access. Finally, CVE-2026-61378 is a divide-by-zero vulnerability that can cause a system crash when triggered by a local attacker.
According to CISA's Industrial Control Systems (ICS) advisory, successful exploitation of these vulnerabilities could allow an attacker with local or physical access to cause memory corruption, unintended information disclosure, application instability, or a denial-of-service condition. The advisory highlights that the affected versions of Productivity Suite are those less than or equal to v4.6.2.2.
AutomationDirect has addressed these vulnerabilities in Productivity Suite version v4.6.2.2. Users are strongly advised to update to this version or later to mitigate the risks associated with these flaws.
This coordinated disclosure of multiple memory corruption vulnerabilities underscores the importance of timely patching for industrial control systems. Users of AutomationDirect Productivity Suite should prioritize updating their systems to the latest version to protect against potential exploitation and ensure operational stability.