SB2025013112 - Multiple vulnerabilities in Rockwell Automation FactoryTalk AssetCentre

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Inadequate Encryption Strength (CVE-ID: CVE-2025-0477)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a weak encryption methodology. A remote attacker can extract passwords belonging to other users of the application.

2) Insufficiently protected credentials (CVE-ID: CVE-2025-0497)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to storing credentials in the configuration file of EventLogAttachmentExtractor, ArchiveExtractor, LogCleanUp or ArchiveLogCleanUp packages. A local user can gain access to the target application.

3) Insufficiently protected credentials (CVE-ID: CVE-2025-0498)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to insecure storage of FactoryTalk Security user tokens. A local user can steal a token and impersonate another user.

Remediation

Install update from vendor's website.

References

• https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-05