This vulnerability arises from unquoted executable paths in the External Tools configuration file of Studio 5000 Logix Designer. Because these paths include spaces and are not properly quoted, the operating system may execute malicious executables placed in locations earlier in the search path. An attacker who can plant such a malicious executable could achieve arbitrary code execution under the context of the logged-in user. The CVSS 4.0 base score is 7.3, indicating high severity, with attack vector local, high attack complexity, partial privileges required, and user interaction needed.

Successful exploitation allows an attacker to execute arbitrary code with the same permissions as the user running Studio 5000 Logix Designer. This can lead to unauthorized actions on the affected system, potentially compromising system integrity and confidentiality depending on user privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious about the locations of executables in their search path and avoid running the application with elevated privileges. Review and correct the External Tools configuration to ensure executable paths are properly quoted if possible.