Vulnerability-Lookup

WID-SEC-W-2026-2336

Vulnerability from csaf_certbund - Published: 2026-07-14 22:00 - Updated: 2026-07-14 22:00

Summary

Rockwell Automation Studio 5000 Logix Designer: Mehrere Schwachstellen ermöglichen Codeausführung

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Studio 5000 ist eine Produktsuite zur Gestaltung von Industriesteuerungen und -Prozessen.

Angriff: Ein lokaler Angreifer kann mehrere Schwachstellen in Rockwell Automation Studio 5000 Logix Designer ausnutzen, um beliebigen Programmcode auszuführen.

Betroffene Betriebssysteme: - Sonstiges - Windows

CVE-2026-9108

Affected products

Known affected 12 products

Product	Identifier	Version	Remediation
Rockwell Automation Studio 5000 Logix Designer <33.03 Rockwell Automation / Studio 5000		Logix Designer <33.03
Rockwell Automation Studio 5000 Logix Designer <37.00 Rockwell Automation / Studio 5000		Logix Designer <37.00
Rockwell Automation Studio 5000 Logix Designer <36.01 Rockwell Automation / Studio 5000		Logix Designer <36.01
Rockwell Automation Studio 5000 Logix Designer <36.00 Rockwell Automation / Studio 5000		Logix Designer <36.00
Rockwell Automation Studio 5000 Logix Designer <35.02 Rockwell Automation / Studio 5000		Logix Designer <35.02
Rockwell Automation Studio 5000 Logix Designer <34.04 Rockwell Automation / Studio 5000		Logix Designer <34.04
Rockwell Automation Studio 5000 Logix Designer <33.04 Rockwell Automation / Studio 5000		Logix Designer <33.04
Rockwell Automation Studio 5000 Logix Designer <33.02 Rockwell Automation / Studio 5000		Logix Designer <33.02
Rockwell Automation Studio 5000 Logix Designer <32.05 Rockwell Automation / Studio 5000		Logix Designer <32.05
Rockwell Automation Studio 5000 Logix Designer <34.02 Rockwell Automation / Studio 5000		Logix Designer <34.02
Rockwell Automation Studio 5000 Logix Designer <35.01 Rockwell Automation / Studio 5000		Logix Designer <35.01
Rockwell Automation Studio 5000 Logix Designer <34.03 Rockwell Automation / Studio 5000		Logix Designer <34.03

CVE-2026-9127

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
Rockwell Automation Studio 5000 Logix Designer <36.00 Rockwell Automation / Studio 5000		Logix Designer <36.00
Rockwell Automation Studio 5000 Logix Designer <32.05 Rockwell Automation / Studio 5000		Logix Designer <32.05
Rockwell Automation Studio 5000 Logix Designer <33.02 Rockwell Automation / Studio 5000		Logix Designer <33.02
Rockwell Automation Studio 5000 Logix Designer <34.02 Rockwell Automation / Studio 5000		Logix Designer <34.02
Rockwell Automation Studio 5000 Logix Designer <35.01 Rockwell Automation / Studio 5000		Logix Designer <35.01

CVE-2026-9128

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
Rockwell Automation Studio 5000 Logix Designer <33.03 Rockwell Automation / Studio 5000		Logix Designer <33.03
Rockwell Automation Studio 5000 Logix Designer <36.00 Rockwell Automation / Studio 5000		Logix Designer <36.00
Rockwell Automation Studio 5000 Logix Designer <33.02 Rockwell Automation / Studio 5000		Logix Designer <33.02
Rockwell Automation Studio 5000 Logix Designer <32.05 Rockwell Automation / Studio 5000		Logix Designer <32.05
Rockwell Automation Studio 5000 Logix Designer <34.02 Rockwell Automation / Studio 5000		Logix Designer <34.02
Rockwell Automation Studio 5000 Logix Designer <35.01 Rockwell Automation / Studio 5000		Logix Designer <35.01
Rockwell Automation Studio 5000 Logix Designer <34.03 Rockwell Automation / Studio 5000		Logix Designer <34.03

References

6 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.rockwellautomation.com/en-us/trust-ce…	external
https://euvd.enisa.europa.eu/enisa/EUVD-2026-43711	external
https://euvd.enisa.europa.eu/enisa/EUVD-2026-43708	external
https://euvd.enisa.europa.eu/enisa/EUVD-2026-43707	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Studio 5000 ist eine Produktsuite zur Gestaltung von Industriesteuerungen und -Prozessen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann mehrere Schwachstellen in Rockwell Automation Studio 5000 Logix Designer ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2336 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2336.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2336 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2336"
      },
      {
        "category": "external",
        "summary": "Rockwell Automation Security Advisory SD1783 vom 2026-07-14",
        "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html"
      },
      {
        "category": "external",
        "summary": "EUVD Security Advisory vom 2026-07-14",
        "url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-43711"
      },
      {
        "category": "external",
        "summary": "EUVD Security Advisory vom 2026-07-14",
        "url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-43708"
      },
      {
        "category": "external",
        "summary": "EUVD Security Advisory vom 2026-07-14",
        "url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-43707"
      }
    ],
    "source_lang": "en-US",
    "title": "Rockwell Automation Studio 5000 Logix Designer: Mehrere Schwachstellen erm\u00f6glichen Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2026-07-14T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-16T17:41:56.518+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2336",
      "initial_release_date": "2026-07-14T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-14T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c37.00",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c37.00",
                  "product_id": "T056501"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 37.00",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 37.00",
                  "product_id": "T056501-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__37.00"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c36.01",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c36.01",
                  "product_id": "T056502"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 36.01",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 36.01",
                  "product_id": "T056502-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__36.01"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c35.02",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c35.02",
                  "product_id": "T056503"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 35.02",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 35.02",
                  "product_id": "T056503-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__35.02"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c34.04",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c34.04",
                  "product_id": "T056504"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 34.04",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 34.04",
                  "product_id": "T056504-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__34.04"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c33.04",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c33.04",
                  "product_id": "T056505"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 33.04",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 33.04",
                  "product_id": "T056505-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__33.04"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c32.05",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c32.05",
                  "product_id": "T056506"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 32.05",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 32.05",
                  "product_id": "T056506-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__32.05"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c34.02",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c34.02",
                  "product_id": "T056508"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 34.02",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 34.02",
                  "product_id": "T056508-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__34.02"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c35.01",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c35.01",
                  "product_id": "T056509"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 35.01",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 35.01",
                  "product_id": "T056509-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__35.01"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c34.03",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c34.03",
                  "product_id": "T056510"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 34.03",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 34.03",
                  "product_id": "T056510-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__34.03"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c33.03",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c33.03",
                  "product_id": "T056512"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 33.03",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 33.03",
                  "product_id": "T056512-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__33.03"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c36.00",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c36.00",
                  "product_id": "T056514"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 36.00",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 36.00",
                  "product_id": "T056514-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__36.00"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Logix Designer \u003c33.02",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer \u003c33.02",
                  "product_id": "T056517"
                }
              },
              {
                "category": "product_version",
                "name": "Logix Designer 33.02",
                "product": {
                  "name": "Rockwell Automation Studio 5000 Logix Designer 33.02",
                  "product_id": "T056517-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rockwellautomation:studio_5000:logix_designer__33.02"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Studio 5000"
          }
        ],
        "category": "vendor",
        "name": "Rockwell Automation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-9108",
      "product_status": {
        "known_affected": [
          "T056512",
          "T056501",
          "T056502",
          "T056514",
          "T056503",
          "T056504",
          "T056505",
          "T056517",
          "T056506",
          "T056508",
          "T056509",
          "T056510"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-9108"
    },
    {
      "cve": "CVE-2026-9127",
      "product_status": {
        "known_affected": [
          "T056514",
          "T056506",
          "T056517",
          "T056508",
          "T056509"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-9127"
    },
    {
      "cve": "CVE-2026-9128",
      "product_status": {
        "known_affected": [
          "T056512",
          "T056514",
          "T056517",
          "T056506",
          "T056508",
          "T056509",
          "T056510"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-9128"
    }
  ]
}

CVE-2026-9108 (GCVE-0-2026-9108)

Vulnerability from cvelistv5 – Published: 2026-07-14 15:09 – Updated: 2026-07-14 15:54

Title

Studio 5000 Logix Designer® – Multiple Vulnerabilities

Summary

A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.

Severity

5.4 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 15:54 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

Rockwell icscert root Scorecard

References

1 reference

URL	Tags
https://www.rockwellautomation.com/en-us/trust-ce…

Impacted products

1 product

Vendor	Product	Version
Rockwell Automation	Studio 5000 Logix Designer	Affected: V36.00, 35.00,35.01, 34.00-34.03, 33.00-33.03, 32.00-32.04 and older

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9108",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T15:54:19.005009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T15:54:25.440Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Studio 5000 Logix Designer",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "V36.00, 35.00,35.01, 34.00-34.03, 33.00-33.03, 32.00-32.04 and older"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A path traversal security issue exists within\u0026nbsp;Studio 5000 Logix Designer\u00ae\u0026nbsp;due to improper limitation of file paths within ACD project files. The software does not\u0026nbsp;sanitize or\u0026nbsp;validate\u0026nbsp;file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution."
            }
          ],
          "value": "A path traversal security issue exists within\u00a0Studio 5000 Logix Designer\u00ae\u00a0due to improper limitation of file paths within ACD project files. The software does not\u00a0sanitize or\u00a0validate\u00a0file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T15:09:37.108Z",
        "orgId": "b73dd486-f505-4403-b634-40b078b177f0",
        "shortName": "Rockwell"
      },
      "references": [
        {
          "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html"
        }
      ],
      "source": {
        "advisory": "SD1783",
        "discovery": "INTERNAL"
      },
      "title": "Studio 5000 Logix Designer\u00ae \u2013 Multiple Vulnerabilities",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0",
    "assignerShortName": "Rockwell",
    "cveId": "CVE-2026-9108",
    "datePublished": "2026-07-14T15:09:37.108Z",
    "dateReserved": "2026-05-20T17:20:44.539Z",
    "dateUpdated": "2026-07-14T15:54:25.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9127 (GCVE-0-2026-9127)

Vulnerability from cvelistv5 – Published: 2026-07-14 15:10 – Updated: 2026-07-14 15:54

Title

Studio 5000 Logix Designer® – Multiple Vulnerabilities

Summary

A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 15:54 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

Rockwell icscert root Scorecard

References

1 reference

URL	Tags
https://www.rockwellautomation.com/en-us/trust-ce…

Impacted products

1 product

Vendor	Product	Version
Rockwell Automation	Studio 5000 Logix Designer	Affected: V35.00,34.00,34.01, 33.00,33.02, 32.00-32.04 and older

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9127",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T15:54:40.733635Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T15:54:46.504Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Studio 5000 Logix Designer",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "V35.00,34.00,34.01, 33.00,33.02, 32.00-32.04 and older"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A remote code execution security issue exists within\u0026nbsp;Studio 5000 Logix Designer\u00ae\u0026nbsp;due to incorrect authorization on a\u0026nbsp;configuration file.\u0026nbsp;This can\u0026nbsp;allow\u0026nbsp;any authenticated user to\u0026nbsp;modify\u0026nbsp;the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external\u0026nbsp;tools\u0026nbsp;functionality.\u0026nbsp;"
            }
          ],
          "value": "A remote code execution security issue exists within\u00a0Studio 5000 Logix Designer\u00ae\u00a0due to incorrect authorization on a\u00a0configuration file.\u00a0This can\u00a0allow\u00a0any authenticated user to\u00a0modify\u00a0the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external\u00a0tools\u00a0functionality."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T15:10:38.749Z",
        "orgId": "b73dd486-f505-4403-b634-40b078b177f0",
        "shortName": "Rockwell"
      },
      "references": [
        {
          "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html"
        }
      ],
      "source": {
        "advisory": "SD1783",
        "discovery": "INTERNAL"
      },
      "title": "Studio 5000 Logix Designer\u00ae \u2013 Multiple Vulnerabilities",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0",
    "assignerShortName": "Rockwell",
    "cveId": "CVE-2026-9127",
    "datePublished": "2026-07-14T15:10:38.749Z",
    "dateReserved": "2026-05-20T17:48:19.830Z",
    "dateUpdated": "2026-07-14T15:54:46.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9128 (GCVE-0-2026-9128)

Vulnerability from cvelistv5 – Published: 2026-07-14 15:12 – Updated: 2026-07-14 15:55

Title

Studio 5000 Logix Designer® – Multiple Vulnerabilities

Summary

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 15:55 UTC

CWE

CWE-428 - Unquoted Search Path or Element

Assigner

Rockwell icscert root Scorecard

References

1 reference

URL	Tags
https://www.rockwellautomation.com/en-us/trust-ce…

Impacted products

1 product

Vendor	Product	Version
Rockwell Automation	Studio 5000 Logix Designer	Affected: V35.00, 34.00-34.02, 33.00-33.02, 32.00-32.04 and older

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9128",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T15:55:36.587930Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T15:55:42.919Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Studio 5000 Logix Designer",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "V35.00, 34.00-34.02, 33.00-33.02, 32.00-32.04 and older"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A code execution security issue exists within\u0026nbsp;Studio 5000 Logix Designer\u00ae\u0026nbsp;due to an unquoted search path in the External Tools configuration. The executable paths specified in the external\u0026nbsp;tools\u0026nbsp;configuration\u0026nbsp;file are not properly quoted, and because these paths\u0026nbsp;contain\u0026nbsp;spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution\u0026nbsp;with the same permissions\u0026nbsp;of\u0026nbsp;the user running the application.\u0026nbsp;"
            }
          ],
          "value": "A code execution security issue exists within\u00a0Studio 5000 Logix Designer\u00ae\u00a0due to an unquoted search path in the External Tools configuration. The executable paths specified in the external\u00a0tools\u00a0configuration\u00a0file are not properly quoted, and because these paths\u00a0contain\u00a0spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution\u00a0with the same permissions\u00a0of\u00a0the user running the application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-428",
              "description": "CWE-428: Unquoted Search Path or Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T15:12:49.393Z",
        "orgId": "b73dd486-f505-4403-b634-40b078b177f0",
        "shortName": "Rockwell"
      },
      "references": [
        {
          "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html"
        }
      ],
      "source": {
        "advisory": "SD1783",
        "discovery": "INTERNAL"
      },
      "title": "Studio 5000 Logix Designer\u00ae \u2013 Multiple Vulnerabilities",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0",
    "assignerShortName": "Rockwell",
    "cveId": "CVE-2026-9128",
    "datePublished": "2026-07-14T15:12:49.393Z",
    "dateReserved": "2026-05-20T17:48:35.972Z",
    "dateUpdated": "2026-07-14T15:55:42.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

WID-SEC-W-2026-2336

CVE-2026-9108 (GCVE-0-2026-9108)

CVE-2026-9127 (GCVE-0-2026-9127)

CVE-2026-9128 (GCVE-0-2026-9128)

Tags

Sightings

Nomenclature

Related by attack behaviour