Arbitrary code execution vulnerabilities found in Rockwell Automation Studio 5000 Logix Designer
Three vulnerabilities in Rockwell Automation's Studio 5000 Logix Designer could allow an attacker to execute arbitrary code on a workstation. The flaws involve path traversal via project files and unquoted search paths in external tool configurations. Update to the latest software versions immediately to mitigate these risks.
Summary
Rockwell Automation has disclosed three security vulnerabilities affecting its Studio 5000 Logix Designer, the integrated design environment used to develop and manage industrial automation systems for Logix 5000 controllers. The flaws allow for arbitrary code execution through manipulated project files or modified external tool configurations.
The vulnerabilities present different attack vectors: one involves a path traversal issue within .ACD project files, while the others target the application's "External Tools" configuration via incorrect authorization and unquoted search paths.
Technical details
The first vulnerability, CVE-2026-9108, is a path traversal flaw (CWE-22). When opening an .ACD project file, the software fails to sanitize or validate embedded file names within the file structure. An attacker can craft a malicious project file containing path traversal sequences that escape the intended extraction directory, writing arbitrary files to controlled locations on the local file system.
The second and third vulnerabilities target the External Tools functionality. CVE-2026-9127 (CWE-863) involves incorrect authorization on a configuration file, which allows an authenticated user to modify paths for external tools. This can be used to point a tool toward a malicious executable.
Complementing this is CVE-2026-9128 (CWE-428), which stems from unquoted search paths in the External Tools configuration. Because these paths contain spaces and lack quotation marks, the operating system may resolve them to unintended executables placed earlier in the search order. An attacker could plant a malicious file in a specific location within the search path to trigger execution with the same permissions as the user running Studio 5000.
Affected products and fixed versions
The following table outlines the vulnerable versions of Studio 5000 Logix Designer and the corresponding fixed releases.
| Vulnerable Versions | Fixed Versions |
|---|---|
| V36.00, V35.00, V35.01, V34.00-34.03, V33.00-33.03, V32.00-32.04 and older | V37.00, V36.01, V35.02, V34.04, V33.04, V32.05 |
| V35.00, V34.00, V34.01, V33.00, V33.02, V32.00-32.04 and older | V36.00, V35.01, V34.02, V33.02, V32.05 |
| V35.00, V34.00-34.02, V33.00-33.02, V32.00-32.04 and older | V36.00, V35.01, V34.03, V33.03, V32.05 |
Defender guidance
To mitigate these risks, prioritize upgrading Studio 5000 Logix Designer to the fixed versions listed above. If an immediate upgrade is not possible, implement the following controls:
- Monitor Project File Integrity: Treat all
.ACDproject files received from external or untrusted sources as potentially malicious. Verify the origin of any project file before attempting to open it in the design environment. - Restrict External Tool Configuration: Audit the "External Tools" configuration within your Studio 5000 environments. Ensure that paths to executables are explicitly defined and that users have restricted permissions regarding the modification of these configuration files.
- Secure Search Paths: For workstations running affected versions, ensure that no unauthorized executables can be placed in directories that might fall within the unquoted search paths used by the application's external tools.
Sources
