PT-2025-3909 · Rockwell Automation · Factorytalk Assetcentre

Alban Avdiji · Published 2025-01-14 · Updated 2025-11-04 · CVE-2025-0477

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk AssetCentre versions prior to V15.00.001

Description An encryption issue exists due to a weak encryption methodology, which could allow a threat actor to extract passwords belonging to other users of the application. This poses severe risks to industrial control systems.

Recommendations For Rockwell Automation FactoryTalk AssetCentre versions prior to V15.00.001, consider updating to version V15.00.001 or later to resolve the issue. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Inadequate Encryption Strength

Weakness Enumeration

CWE-522

CWE-326

Related Identifiers

BDU:2025-01155

BDU:2025-01156

BDU:2025-01157

CVE-2025-0477

Affected Products

Factorytalk Assetcentre

References · 29

• https://osv.dev/vulnerability/CVE-2025-0477 · Vendor Advisory
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0477 · Security Note
• https://bdu.fstec.ru/vul/2025-01157 · Security Note
• https://bdu.fstec.ru/vul/2025-01156 · Security Note
• https://bdu.fstec.ru/vul/2025-01155 · Security Note
• https://twitter.com/transilienceai/status/1888379821031329802 · Twitter Post
• https://twitter.com/transilienceai/status/1886933780377821475 · Twitter Post
• https://twitter.com/transilienceai/status/1889500958775976451 · Twitter Post
• https://twitter.com/transilienceai/status/1887844742056022371 · Twitter Post
• https://twitter.com/aisandollai/status/1924938310629404809 · Twitter Post
• https://twitter.com/transilienceai/status/1888742612594483405 · Twitter Post
• https://t.me/cvedetector/16809 · Telegram Post
• https://t.me/cvenotify/109255 · Telegram Post
• https://twitter.com/transilienceai/status/1889105562735919290 · Twitter Post