Productivity Suite: Weak Password Recovery Mechanism for Forgotten Password
CVE-2025-61977 is a high-severity weak password recovery mechanism for forgotten password vulnerability in Productivity Suite from AutomationDirect, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. Affected Productivity Suite versions: SW V4.2.1.9 and earlier. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.15% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Productivity 1000 P1-540 CPU to SW v4.4.1.19 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| AutomationDirect | Productivity Suite | SW V4.2.1.9 and earlier | Not stated |
| AutomationDirect | Productivity 3000 P3-622 CPU | SW V4.2.1.9 and earlier | Not stated |
| AutomationDirect | Productivity 3000 P3-550E CPU | SW V4.2.1.9 and earlier | Not stated |
| AutomationDirect | Productivity 3000 P3-530 CPU | SW v4.4.1.19 and earlier | Not stated |
| AutomationDirect | Productivity 2000 P2-622 CPU | SW v4.4.1.19 and earlier | Not stated |
| AutomationDirect | Productivity 2000 P2-550 CPU | SW v4.4.1.19 and earlier | Not stated |
| AutomationDirect | Productivity 1000 P1-550 CPU | SW v4.4.1.19 and earlier | Not stated |
| AutomationDirect | Productivity 1000 P1-540 CPU | before SW v4.4.1.19 | SW v4.4.1.19 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- HighSuccess depends on conditions outside the attacker's control.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (hq.dhs.gov).
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 4.0 | 7.3 | High | CNA (hq.dhs.gov) |
| CVSS 3.1 | 7.0 | High | CNA (hq.dhs.gov) |
Official description
A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an attacker to decrypt an encrypted project by answering just one recovery question.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
How developers prevent this class of flaw
- Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
- Do not use standard weak security questions and use several security questions.
- Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
More Weak Password Recovery Mechanism for Forgotten Password vulnerabilities (CWE-640)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
Other vulnerabilities in Productivity Suite
- 7.0 High severity
- 7.0 High severity
- 7.5 High severity
- 7.1 High severity
- 8.8 High severity
- 10.0 Critical severity
Recent Weak Password Recovery Mechanism for Forgotten Password vulnerabilities
- 8.1 High severity
- 9.8 Critical severity
- 9.8 Critical severity
- 8.9 High severity
- 8.8 High severity
- 9.8 Critical severity
Spotted an error? Tell us.