Rockwell Studio 5000 Logix Designer® – Arbitrary Code Execution Vulnerability

An attacker with access to a Logix Designer project file could execute arbitrary code on the engineering workstation when the file is opened, potentially compromising all PLCs and control logic that the workstation manages.

Industrial facilities using Rockwell Automation PLCs and control logic rely on Logix Designer for programming and maintenance. This vulnerability affects all engineering teams and system integrators who develop or modify PLC logic using Studio 5000. Any facility where multiple control systems are managed from shared engineering workstations faces elevated risk of wide-spread compromise.

An attacker crafts a malicious Logix Designer project file and distributes it via email, file share, or supply chain channel. When an engineer opens the file in Studio 5000 Logix Designer to review or modify it, the malicious code runs with the privilege of the engineering workstation. From there, the attacker gains control of the workstation and can modify PLC programs, steal credentials, or pivot to other control systems on the network.