CVE-2024-1167 is a Medium severity XML external entity flaw, scored 5.5, in SEW-EURODRIVE MOVITOOLS MotionStudio 6.5.0.2. Processing XML can lead to unrestricted file access. SEW-EURODRIVE recommends updating to version 6.70 when it is available and blocking outbound connections for SEWManager.exe.
What's affected
The record and the CISA advisory ICSA-24-016-01 list MOVITOOLS MotionStudio 6.5.0.2. SEW-EURODRIVE recommends updating to 6.70 as soon as it is available. The advisory does not say when that will be.
On scoring, the record gives CVSS 5.5. The CISA advisory shows CVSS v3.1 at 5.5 in its detail section, CVSS v4.0 at 5.6, and lists 5.6 for CVSS v3 in its summary, which disagrees with its own detail section. I use 5.5 from the record and detail section.
How to check if you're exposed
MotionStudio is an engineering tool for SEW drives. Check installed versions on engineering workstations through the Windows installed programs list or the tool's About page. Version 6.5.0.2 is the one listed.
Then check whether a firewall rule blocks outgoing TCP connections for SEWManager.exe, which is SEW-EURODRIVE's interim mitigation. CISA says the flaw is not exploitable remotely and notes no known public exploitation.
What to do now
- Find workstations with MOVITOOLS MotionStudio 6.5.0.2.
- Add a firewall rule blocking outgoing TCP connections from SEWManager.exe, as the SEW-EURODRIVE advisory describes.
- Update to 6.70 once SEW-EURODRIVE releases it.
- Open project and configuration files only from sources you trust, since the flaw involves XML processing.
- Keep control system devices off the internet and behind firewalls, and use current VPNs for remote access, as CISA advises.
Why it matters
The class is improper restriction of XML external entity reference, CWE-611. An XML parser that resolves external entities can be told to read local files or reach other systems, which is why the standard fix is to turn the feature off.
Here the record describes unrestricted file access when the tool processes XML. The user interaction requirement in the CVSS vector means someone has to open a crafted file, and the local attack vector keeps the score at Medium. CISA reports no public exploitation, and the record's KEV flag is false.
Quick check
Is there a patch?
SEW-EURODRIVE recommends 6.70 when available. Until then, block outgoing TCP for SEWManager.exe.
Can it be exploited remotely?
CISA says it is not exploitable remotely.
Sources
Last reviewed: 19 October 2026.
