Back to Database
Status published
Critical
CVE-2025-36535
AutomationDirect MB-Gateway Missing Authentication for Critical Function
Vulnerability Description
The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational disruption, or arbitrary code execution depending on the environment and exposed functionality.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-36535
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Souvik Kandar reported this vulnerability to AutomationDirect.
References
More from AutomationDirect
View All →CVE-2025-67652
AutomationDirect CLICK Programmable Logic Controller Weak Encoding for Password
Medium
6.1
CVE-2025-62688
AutomationDirect Productivity Suite Incorrect Permission Assignment for Critical Resource
Medium
6.9
CVE-2025-62498
AutomationDirect Productivity Suite Relative Path Traversal
High
8.6
CVE-2025-61977
AutomationDirect Productivity Suite Weak Password Recovery Mechanism for Forgotten Password
High
7.3
CVE-2025-61934
AutomationDirect Productivity Suite Binding to an Unrestricted IP Address CWE-1327
Critical
9.3
Affected Vendor
AutomationDirect
View all reports →Affected Software
MB-Gateway
Vulnerable Versions:
All
Timeline
Official Publish:
May 21st, 2025
Last Modified:
May 22nd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H