Home

Description

A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to extract files using path traversal sequences, resulting in execution of scripts with Administrator privileges on system reboot.

PUBLISHED Reserved 2025-10-13 | Published 2025-11-11 | Updated 2025-11-12 | Assigner Rockwell




HIGH: 8.9CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status
unaffected

2.02 and prior
affected

References

www.rockwellautomation.com/...dvisories/advisory.SD1760.html

cve.org (CVE-2025-11697)

nvd.nist.gov (CVE-2025-11697)

Download JSON