Studio 5000 Logix Designer CVE-2026-9108

Exploitation requires a target user to actively open a maliciously crafted ACD project file in Studio 5000 Logix Designer on a Windows engineering workstation - the CVSS 4.0 UI:A metric confirms this active user interaction is mandatory and cannot be bypassed remotely. The attacker must have a delivery mechanism to place the ACD file within reach of the target, such as email phishing, a compromised shared project repository, or physical media. The AT:P (attack preconditions) metric indicates that a writable filesystem path capable of leading to code execution must exist and be reachable via path traversal from the extraction directory - this is typical in default Windows user profile configurations but is not guaranteed in hardened environments. Exploitation is bounded to the local engineering workstation filesystem (SC:N/SI:N/SA:N); the attacker cannot directly interact with PLC hardware through this vulnerability alone. The PR:L metric in the vendor-provided vector suggests some low-level privilege context is factored in, though the primary limiting factor is the mandatory user-open interaction.

The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:A) and base score of 5.4 reflect the constrained exploitation conditions: local attack vector, high attack complexity, presence of specific preconditions (AT:P), low-privilege requirement, and mandatory active user interaction. Despite the full CIA impact within the vulnerable system (VC:H/VI:H/VA:H), the real-world exploitation bar is meaningful - the attacker must craft a malicious ACD file, successfully deliver it to a target ICS engineer, and convince the engineer to open it, all while relying on a writable code-execution-capable path being present on the workstation. The absence of any EPSS score in the available data means exploitation probability cannot be quantified numerically. No CISA KEV listing and no public proof-of-concept code have been identified, supporting a lower-urgency assessment for broad environments. However, for OT environments where engineering workstations have privileged access to PLC programming and network segmentation is often incomplete, even a targeted, manual exploitation attempt carries disproportionate downstream risk - a compromised Logix Designer workstation could subsequently be used to push modified PLC logic to operational controllers. The scope change metrics (SC:N/SI:N/SA:N) confirm the CVSS vector itself does not account for this downstream OT risk.

An attacker targeting an OT environment crafts a malicious ACD project file with filenames embedded in its archive structure containing path traversal sequences (e.g., '../../AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/payload.bat'), then delivers the file to a control systems engineer via spear-phishing or by compromising a shared project file repository used by the engineering team. When the engineer opens the file in Studio 5000 Logix Designer, the extraction routine writes the attacker's payload to the startup folder, achieving persistent code execution on the engineering workstation at next login. No public proof-of-concept has been identified, but the technique is well-understood for CWE-22 vulnerabilities in archive parsers.