CVE-2025-11697CWE-200information-disclosure

CVE-2025-11697

published November 11, 2025

CVSS

8.9

EPSS

Percentile

4.2

In the wild

Unconfirmed

What it is

A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to extract files using path traversal sequences, resulting in execution of scripts with Administrator privileges on system reboot.

The record

Technical detail

CVSS: 8.9 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00155 · 4.2th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2025-11-11T19:15Z

References (1)

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1760.html · [email protected]

EPSS history

Timeline

11 NOV 13:49Z
Studio 5000 ® Simulation Interface Local Code Execution
cvelistv5