CVE-2026-9108

Katalog CVE

CVSS 7.5 · High EPSS 0,18%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada rockwellautomation studio 5000 logix designer. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

25 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1783.html advisory vendor