7.5highHigh
CVE-2026-9108
Rockwellautomation Studio 5000 Logix Designer
A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.
Exploitation status
- A vendor advisory or patch reference has been published.
What the metrics mean
- It is requires local access to the machine.
- For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
- To exploit it, an ordinary user account is needed.
- Beyond that, someone has to be persuaded to take an action first.
Scoring
- CVSS
- 7.5 (v3.1)
- Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H- CVSS v4
- 5.4
- Weakness
- CWE-22
- Assigned by
- PSIRT@rockwellautomation.com
Dates
- Published
- 2026-07-14
- Last modified
- 2026-08-25
- Sources
- NVD
Affected products
- Rockwellautomation Studio 5000 Logix Designer- 32.05, 33.00 - 33.04, 34.00 - 34.04, 35.00 - 35.02, 36.00
As listed in the NVD configuration data. Not a statement about your estate.