CVE-2025-9437

A security issue exists within the Studio 5000 Logix Designer add-on profile (AOP) for the ArmorStart Classic distributed motor controller, resulting in denial-of-service. This vulnerability is possible due to the input of invalid values into Component Object Model (COM) methods.

CVSS

No CVSS.

References

Link	Resource
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1751.html

Configurations

No configuration.

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Existe un problema de seguridad dentro del perfil de complemento (AOP) de Studio 5000 Logix Designer para el controlador de motor distribuido ArmorStart Classic, resultando en denegación de servicio. Esta vulnerabilidad es posible debido a la introducción de valores no válidos en los métodos del Modelo de Objetos Componentes (COM).

Information

Published : 2025-10-14 12:15

Updated : 2026-10-08 12:10

NVD link : CVE-2025-9437

Mitre link : CVE-2025-9437

CVE.ORG link : CVE-2025-9437

JSON object : View

Products Affected

No product.

CWE

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2025-9437", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9437", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T18:44:09.895895Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "PSIRT@rockwellautomation.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "PSIRT@rockwellautomation.com", "affectedData": [{"vendor": "Rockwell Automation", "product": "ArmorStart AOP", "versions": [{"status": "affected", "version": "V2.05.07"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-14T12:15:34.017", "references": [{"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1751.html", "source": "PSIRT@rockwellautomation.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "PSIRT@rockwellautomation.com", "description": [{"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "A security issue exists within the Studio 5000 Logix Designer add-on profile (AOP) for the ArmorStart Classic distributed motor controller, resulting in denial-of-service. This vulnerability is possible due to the input of invalid values into Component Object Model (COM) methods."}, {"lang": "es", "value": "Existe un problema de seguridad dentro del perfil de complemento (AOP) de Studio 5000 Logix Designer para el controlador de motor distribuido ArmorStart Classic, resultando en denegaci\u00f3n de servicio. Esta vulnerabilidad es posible debido a la introducci\u00f3n de valores no v\u00e1lidos en los m\u00e9todos del Modelo de Objetos Componentes (COM)."}], "lastModified": "2026-10-08T12:10:00.217", "sourceIdentifier": "PSIRT@rockwellautomation.com"}