Logix Designer CVE-2025-9437

Exploitation requires the Studio 5000 Logix Designer ArmorStart Classic (Classic distributed motor controller) Add-On Profile to be installed and present, and the attacker must be able to invoke that AOP's COM methods and pass invalid values to them. The impact is limited to denial-of-service of the engineering software (availability only - no code execution, data disclosure, or integrity change per VC:N/VI:N). The primary limiting factor is reachability of the COM interface: because this is an AOP within a workstation application driven through COM, realistic exploitation is local or via an authorized COM/DCOM client rather than an arbitrary remote host, despite the vendor's AV:N rating - defenders should confirm whether the COM interface is network-exposed in their deployment.

Signals conflict in a way that pulls this well below its headline CVSS 4.0 score of 8.7. The high score is driven almost entirely by VA:H (availability impact) combined with AV:N/AC:L/PR:N/UI:N - i.e. the vendor models this as a remote, unauthenticated, low-complexity denial-of-service. However, the affected component is an Add-On Profile (AOP) that runs inside Studio 5000 Logix Designer, an engineering-workstation application, and the flaw is triggered by passing invalid values into Component Object Model (COM) methods. COM method invocation is characteristically a local or inter-process operation on the workstation, so the AV:N designation is questionable and should be verified with Rockwell - if exploitation actually requires local/DCOM access, the real-world risk is materially lower than 8.7 implies. The EPSS score of 0.37% (28th percentile) is low, there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or imminent widespread exploitation. The input also carries an 'Information Disclosure' tag that directly contradicts the CVSS vector (VC:N, VI:N, VA:H): this is a pure availability/DoS issue with no confidentiality or integrity impact, so that tag appears mislabeled. Net assessment: a legitimate availability bug in OT engineering software, but a moderate priority (patch in normal cycle) rather than an emergency, pending clarification of the true attack vector.

An attacker able to reach the COM interface exposed by the ArmorStart Classic AOP within Studio 5000 Logix Designer supplies invalid values to one or more COM methods, causing an unhandled exceptional condition (CWE-755) that crashes or hangs the engineering software. No public exploit code has been identified, and because the trigger is COM-method input the realistic path is a local process or a client authorized to invoke the AOP's COM interface rather than an arbitrary internet host.