PT-2025-3925 · Rockwell Automation · Factorytalk Assetcentre

Published 2025-01-15 · Updated 2025-01-31 · CVE-2025-0498

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk AssetCentre versions prior to V15.00.001

Description A data exposure issue exists due to insecure storage of FactoryTalk Security user tokens, which could allow a threat actor to steal a token and impersonate another user. This could potentially lead to the disclosure of protected information.

Recommendations For versions prior to V15.00.001, update to V15.00.001 or later to resolve the issue. As a temporary workaround, consider restricting access to FactoryTalk Security user tokens to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2025-01157

CVE-2025-0498

Affected Products

Factorytalk Assetcentre

References · 11

• https://bdu.fstec.ru/vul/2025-01157 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0498 · Vendor Advisory
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0498 · Security Note
• https://vuldb.com/?id.294144 · Note
• https://twitter.com/VulmonFeeds/status/1885130049151475856 · Twitter Post
• https://t.me/cvenotify/109257 · Telegram Post
• https://t.me/cvedetector/16807 · Telegram Post
• https://securityonline.info/cve-2025-0477-cvss-9-8-critical-security-flaw-in-rockwell-automations-factorytalk-assetcentre · Note
• https://twitter.com/CVEnew/status/1885022682292392043 · Twitter Post
• https://rockwellautomation.com/en-ie/trust-center/security-advisories/advisory.SD1721.html · Note