CVE-2025-9437
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A security issue exists within the Studio 5000 Logix Designer add-on profile (AOP) for the ArmorStart Classic distributed motor controller, resulting in denial-of-service. This vulnerability is possible due to the input of invalid values into Component Object Model (COM) methods.
Risk Assessment
An attacker can input invalid values into COM methods, causing a crash or unavailability of Studio 5000 Logix Designer. The risk applies to engineering environments using ArmorStart Classic.
Recommendation
Apply available updates for Studio 5000 Logix Designer and ArmorStart Classic. Restrict access to engineering workstations and validate input data.
Other vulnerabilities in Studio 5000 Logix Designer
See all- CVE-2026-9128High
A code execution vulnerability exists in Studio 5000 Logix Designer due to an unquoted search path in the External Tools configuration. Executable paths containing spaces are not properly quoted, allowing an attacker to place a malicious executable earlier in the search order and achieve arbitrary code execution.
- CVE-2026-9127High
A remote code execution vulnerability exists in Studio 5000 Logix Designer due to incorrect authorization on a configuration file. Any authenticated user can modify the paths of external tools configured within the application. An attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.
- CVE-2026-9108High
A path traversal vulnerability exists in Studio 5000 Logix Designer due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during project opening, allowing path traversal sequences. Exploitation could allow an attacker to write arbitrary files to attacker-controlled locations, potentially leading to code execution.
Original NVD description (English source)
A security issue exists within the Studio 5000 Logix Designer add-on profile (AOP) for the ArmorStart Classic distributed motor controller, resulting in denial-of-service. This vulnerability is possible due to the input of invalid values into Component Object Model (COM) methods.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS