A critical permission assignment vulnerability in AutomationDirect Productivity Suite allows authenticated low-privileged users to elevate their access to full administrative control.

The flaw is an incorrect permission assignment (CWE-732) that permits an authenticated user with low-level privileges to modify their assigned role, effectively achieving full project control.

Successful exploitation results in full unauthorized control over the industrial control project, posing significant risks to operational integrity and system safety. With a CVSS score of 7.1, this high-severity vulnerability could lead to unauthorized modification of automation logic, potential process disruption, and loss of intellectual property within the industrial environment.

Immediate Action: Update the Productivity Suite programming software to version 4.5.0.x or higher and update the firmware of affected Productivity PLCs to the latest available version provided by AutomationDirect.

Proactive Monitoring: Audit system access logs for suspicious account modifications or unexpected changes in user role assignments.

Compensating Controls: Ensure that automation systems are isolated from external networks and strictly enforce access control policies to limit the number of users with low-privileged access to the software.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for complete loss of control over critical industrial infrastructure, administrators must prioritize the update of both the Productivity Suite software and the underlying PLC firmware. Promptly applying these vendor-supplied patches is the only effective way to neutralize the risk of unauthorized privilege escalation and subsequent system compromise.