Multiple vulnerabilities in Rockwell Automation FactoryTalk AssetCentre
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2025-0477 CVE-2025-0497 CVE-2025-0498 |
| CWE-ID | CWE-326 CWE-522 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
FactoryTalk AssetCentre Server applications / Other server solutions |
| Vendor | Rockwell Automation |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Inadequate Encryption Strength
EUVDB-ID: #VU103470
Risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2025-0477
CWE-ID:
CWE-326 - Inadequate Encryption Strength
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a weak encryption methodology. A remote attacker can extract passwords belonging to other users of the application.
MitigationInstall updates from vendor's website.
Vulnerable software versionsFactoryTalk AssetCentre: before 15.00.001
CPE2.3 External linkshttps://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html
https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-05
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Insufficiently protected credentials
EUVDB-ID: #VU103471
Risk: Low
CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2025-0497
CWE-ID:
CWE-522 - Insufficiently Protected Credentials
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to storing credentials in the configuration file of EventLogAttachmentExtractor, ArchiveExtractor, LogCleanUp or ArchiveLogCleanUp packages. A local user can gain access to the target application.
MitigationInstall updates from vendor's website.
Vulnerable software versionsFactoryTalk AssetCentre: before 15.00.001
CPE2.3 External linkshttps://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html
https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-05
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Insufficiently protected credentials
EUVDB-ID: #VU103472
Risk: Low
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2025-0498
CWE-ID:
CWE-522 - Insufficiently Protected Credentials
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to insecure storage of FactoryTalk Security user tokens. A local user can steal a token and impersonate another user.
MitigationInstall updates from vendor's website.
Vulnerable software versionsFactoryTalk AssetCentre: before 15.00.001
CPE2.3 External linkshttps://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html
https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-05
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
