AutomationDirect vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-61389 An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentHigh 7.3 · Jul 16, 2026
• CVE-2026-60063 An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentHigh 7.3 · Jul 16, 2026
• CVE-2025-58429 A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19.High 8.3 · Oct 23, 2025
• CVE-2025-62498 A relative path traversal (ZipSlip) vulnerability was discovered in Productivity Suite software version 4.4.1.19.High 8.6 · Oct 23, 2025
• CVE-2025-61977 A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19.High 7.3 · Oct 23, 2025
• CVE-2025-61934 A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19.Critical 9.3 · Oct 23, 2025
• CVE-2025-58456 A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19.High 8.2 · Oct 23, 2025
• CVE-2025-58078 A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19.High 8.3 · Oct 23, 2025
• CVE-2025-58473 An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60.High 8.2 · Sep 23, 2025
• CVE-2025-57882 An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60.High 8.2 · Sep 23, 2025
• CVE-2025-55069 A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC.High 8.7 · Sep 23, 2025
• CVE-2025-55038 An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60.High 7.6 · Sep 23, 2025
• CVE-2025-59484 The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC.High 8.7 · Sep 23, 2025
• CVE-2025-36535 The embedded web server lacks authentication and access controls, allowing unrestricted remote access.Critical 10 · May 21, 2025
• CVE-2025-0960 AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an attacker abusing the function to cause a deCritical 9.3 · Feb 4, 2025
• CVE-2024-11611 AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability.High 7.8 · Jan 30, 2025
• CVE-2024-11610 AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability.High 7.8 · Jan 30, 2025
• CVE-2024-11609 AutomationDirect C-More EA9 EAP9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.High 7.8 · Jan 30, 2025
• CVE-2024-45368 The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol.High 8.7 · Sep 13, 2024
• CVE-2024-43099 The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC.High 8.7 · Sep 13, 2024
• CVE-2024-24963 A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E 1.2.10.9.Critical 9.8 · May 28, 2024
• CVE-2024-24962 A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-550E 1.2.10.9.Critical 9.8 · May 28, 2024
• CVE-2024-24959 Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9.High 8.2 · May 28, 2024
• CVE-2024-24958 Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9.High 8.2 · May 28, 2024
• CVE-2024-24957 Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9.High 8.2 · May 28, 2024