Studio 5000 Logix Designer CVE-2026-9108

Q: What is the CVSS score of CVE-2026-9108?

CVE-2026-9108 has a CVSS 4.0 base score of 5.4 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-43707 MEDIUM

Path Traversal (CWE-22)

2026-07-14 Rockwell

GHSA-592c-v2mf-x9pf

RCE Path Traversal Studio 5000 Logix Designer Rockwell Automation

5.4

CVSS 4.0 · Vendor: Rockwell

Severity by source

Vendor (Rockwell) PRIMARY

5.4 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector as exploitation occurs on victim's workstation via file open; no attacker privileges required on target; user interaction required to open ACD file; scope unchanged with full CIA impact via arbitrary write.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Rockwell).

CVSS VectorVendor: Rockwell

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 16:08 vuln.today

DescriptionCVE.org

A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.

AnalysisAI

Path traversal in Rockwell Automation's Studio 5000 Logix Designer allows an attacker who can deliver a crafted ACD project file to write arbitrary files to attacker-controlled locations on an engineer's workstation. The software fails to sanitize or validate embedded filenames during the ACD project-open procedure, enabling path traversal sequences to escape the intended extraction directory and potentially achieve code execution. No public exploit code or CISA KEV listing has been identified at time of analysis, but the ICS context makes targeted file-delivery attacks via spear-phishing or shared project repositories a realistic threat vector.

Technical ContextAI

Studio 5000 Logix Designer is Rockwell Automation's primary engineering workstation software for programming Allen-Bradley Programmable Logic Controllers (PLCs), used extensively in operational technology (OT) and industrial control system (ICS) environments. ACD files are proprietary project archives that bundle ladder logic, controller configuration, and associated assets for distribution among engineering teams. The vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the file extraction routine processes embedded filenames from the ACD archive structure without stripping or rejecting path traversal sequences such as '../'. This allows an attacker to direct file writes outside the intended project directory to locations such as startup folders, DLL search path directories, or user profile paths, enabling code execution at the next application or system trigger. The CPE string cpe:2.3:a:rockwell_automation:studio_5000_logix_designer:*:*:*:*:*:*:*:* indicates all tracked versions are potentially affected.

RemediationAI

Consult Rockwell Automation security advisory SD1783 at https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html for the specific patched version and upgrade instructions, as no exact fixed version number is confirmed in the available data. As compensating controls pending patching: restrict engineers to opening ACD project files only from verified, trusted sources with chain-of-custody controls, and implement file-integrity verification for project files received through shared repositories or external channels. Apply application allowlisting (e.g., Windows Defender Application Control) on engineering workstations to block execution of files dropped to non-standard locations, which directly limits the attacker's ability to achieve code execution even if path traversal succeeds. Restrict write permissions on sensitive directories - startup folders, DLL search path locations, and user profile directories - for the account running Logix Designer, accepting the trade-off that some legitimate software installations may require elevated permissions. Network-segment engineering workstations from general corporate networks to reduce the attack surface for file-delivery campaigns.