A remote code execution vulnerability exists in Studio 5000 Logix Designer due to missing authorization checks on a configuration file. It allows any authenticated user to modify the file that specifies paths to external tools. If an attacker changes these paths to point to a malicious executable, any user who interacts with the external tools functionality will cause the system to run the attacker’s code. The vulnerability is rooted in improper handling of authorization, corresponding to CWE-863.

The affected product is Rockwell Automation's Studio 5000 Logix Designer. The issue is present for any user who can authenticate to the application and manipulate the configuration file that controls external tool paths. No specific version information is provided, so all releases of the product may be at risk until patched.

The assigned CVSS score of 7.3 classifies the vulnerability as high severity. The EPSS score is below 1 percent, indicating a low probability of widespread exploitation, and it is not currently listed in the CISA KEV catalog. The attack requires authenticated access; therefore it is most likely to be leveraged in environments where users have sufficient privileges or where credentials can be obtained. Once exploited, the vulnerability would allow arbitrary code execution with the privileges of the affected user, potentially compromising system integrity and confidentiality.