CVE-2026-9127

A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer::::::::
	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer::::::::
	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer::::::::
	cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:35.00:::::::*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Existe un problema de seguridad de ejecución remota de código dentro de Studio 5000 Logix Designer® debido a una autorización incorrecta en un archivo de configuración. Esto puede permitir a cualquier usuario autenticado modificar las rutas de las herramientas externas configuradas dentro de la aplicación. Si se explota, un atacante podría alterar la configuración para que apunte a un ejecutable malicioso, lo que resultaría en ejecución de código arbitrario cuando cualquier usuario interactúe con la funcionalidad de herramientas externas.

Information

Published : 2026-07-14 16:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-9127

Mitre link : CVE-2026-9127

CVE.ORG link : CVE-2026-9127

JSON object : View

Products Affected

rockwellautomation

studio_5000_logix_designer

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-9127", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9127", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T15:54:40.733635Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "PSIRT@rockwellautomation.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "PSIRT@rockwellautomation.com", "affectedData": [{"vendor": "Rockwell Automation", "product": "Studio 5000 Logix Designer", "versions": [{"status": "affected", "version": "V35.00,34.00,34.01, 33.00,33.02, 32.00-32.04 and older"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T16:17:05.347", "references": [{"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html", "tags": ["Vendor Advisory"], "source": "PSIRT@rockwellautomation.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "PSIRT@rockwellautomation.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A remote code execution security issue exists within\u00a0Studio 5000 Logix Designer\u00ae\u00a0due to incorrect authorization on a\u00a0configuration file.\u00a0This can\u00a0allow\u00a0any authenticated user to\u00a0modify\u00a0the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external\u00a0tools\u00a0functionality."}, {"lang": "es", "value": "Existe un problema de seguridad de ejecuci\u00f3n remota de c\u00f3digo dentro de Studio 5000 Logix Designer\u00ae debido a una autorizaci\u00f3n incorrecta en un archivo de configuraci\u00f3n. Esto puede permitir a cualquier usuario autenticado modificar las rutas de las herramientas externas configuradas dentro de la aplicaci\u00f3n. Si se explota, un atacante podr\u00eda alterar la configuraci\u00f3n para que apunte a un ejecutable malicioso, lo que resultar\u00eda en ejecuci\u00f3n de c\u00f3digo arbitrario cuando cualquier usuario interact\u00fae con la funcionalidad de herramientas externas."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C546B21-3BC4-419A-BFE8-DC7E4B54F5E7", "versionEndIncluding": "32.04"}, {"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB0E80CD-D962-427B-A9BB-EB8512316ACF", "versionEndExcluding": "33.02", "versionStartIncluding": "33.00"}, {"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BAFE675-E30C-4B9A-BF51-EFF97162CCEB", "versionEndExcluding": "34.02", "versionStartIncluding": "34.00"}, {"criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:35.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25EF8390-E355-4C44-9D28-8086BC76F656"}], "operator": "OR"}]}], "sourceIdentifier": "PSIRT@rockwellautomation.com"}