Multiple Vulnerabilities in Rockwell Automation Studio 5000 Logix Designer Pose Risk to Industrial Control Systems
CISA has issued an advisory detailing multiple vulnerabilities in Rockwell Automation's Studio 5000 Logix Designer software, potentially allowing local attackers to execute arbitrary code and disrupt industrial operations.
CISA has alerted organizations to a series of critical vulnerabilities affecting Rockwell Automation's Studio 5000 Logix Designer software, a widely used platform for programming and configuring industrial control systems. The advisory highlights three distinct vulnerabilities, including path traversal, incorrect authorization, and an unquoted search path, which, if exploited, could grant attackers significant control over affected systems.
The most severe of these is CVE-2026-9108, a path traversal vulnerability stemming from improper handling of file paths within ACD project files. The software fails to adequately sanitize or validate file names during the project opening process. This allows a malicious actor to craft an ACD file that, when opened, can write arbitrary files to any location on the file system, potentially leading to arbitrary code execution and system compromise. This vulnerability affects a broad range of versions, from V32.00 up to V36.00.
Another critical flaw, CVE-2026-9127, involves incorrect authorization on a configuration file. This vulnerability allows any authenticated local user to modify the paths of external tools configured within the Studio 5000 Logix Designer application. An attacker could exploit this by altering a configuration to point to a malicious executable. When a legitimate user interacts with the external tools functionality, the malicious code would then execute with the user's privileges, leading to arbitrary code execution.
Complementing these issues is CVE-2026-9128, which arises from an unquoted search path in the External Tools configuration. When paths containing spaces are not properly quoted, the operating system might resolve them to unintended executables earlier in the search order. An attacker could leverage this by placing a malicious executable in a location within the system's search path, leading to arbitrary code execution when the software attempts to launch an external tool.
Successful exploitation of these vulnerabilities by a local attacker could lead to severe consequences, including the execution of arbitrary files, alteration of critical system configurations, and the execution of arbitrary code. Given that Studio 5000 Logix Designer is integral to the operation and maintenance of industrial control systems across various sectors, particularly in critical manufacturing, the potential impact is significant.
Rockwell Automation has released specific patched versions to address these vulnerabilities. Users are strongly advised to upgrade to the following versions: V37.00, 36.01, 35.02, 34.04, 33.04, and 32.05 for CVE-2026-9108; V36.00, 35.01, 34.02, 33.02, and 32.05 for CVE-2026-9127; and V34.02, 33.02, and 32.05 for CVE-2026-9128. For organizations unable to upgrade immediately, Rockwell Automation recommends implementing their security best practices to mitigate risks.
The advisory details CVSS scores indicating a medium to high severity for these vulnerabilities, with CVSS v3.1 scores ranging from 6.7 to 7.5. The vulnerabilities are characterized by local attack vectors, requiring a low privilege level and user interaction, but offering significant impact on confidentiality, integrity, and availability.
This advisory underscores the ongoing challenges in securing industrial control systems, where vulnerabilities in widely deployed software can have far-reaching consequences. Organizations are urged to review the CISA advisory and Rockwell Automation's security advisories promptly to implement necessary patches and mitigations.