Rockwell Automation Studio 5000 Simulation Interface
view advisory published 2025-11-13
Successful exploitation of these vulnerabilities could allow attackers to trigger outbound SMB requests to capture NTLM hashes and execute scripts with Administrator privileges upon system reboot.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-11697US | — | — | ||
A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to extract files using… | ||||
| CVE-2025-11696US | — | — | ||
A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to… | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-25-317-06 JSONself
- ICSA Advisory ICSA-25-317-06 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (2)
- MitigationStudio 5000 Simulation Interface
Rockwell Automation recommends that users upgrade to version 3.0.0 or later.
- MitigationStudio 5000 Simulation Interface
Rockwell Automation recommends that users upgrade to version 3.0.0 or later.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan