ICSA-25-289-01

Rockwell Automation FactoryTalk View Machine Edition and PanelView Plus 7

view advisory published 2025-10-16

Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to access to the device's file system.

describes (2)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-9064US	critical9.1	0.61% (49th)	—	2025-10-14
A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the p…
CVE-2025-9063US	critical9.8	0.39% (32nd)	—	2025-10-14
An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access t…

External citations — patches, advisories, analysis.

MitigationFactoryTalk View Machine Edition
Rockwell Automation encourages users of the affected software to apply the following risk mitigations, if possible:
MitigationPanelView Plus 7
Rockwell Automation encourages users of the affected software to apply the following risk mitigations, if possible:
FixedFactoryTalk View Machine Edition
For CVE-2025-9063 and CVE-2025-9064, update PanelView Plus 7 Performance Series B V14.103 firmware package.
https://compatibility.rockwellautomation.com/Pages/MultiProductFindDownloads.aspx?crumb=112&mode=3&refSoft=1&versions=61168
FixedPanelView Plus 7
For CVE-2025-9063 and CVE-2025-9064, update PanelView Plus 7 Performance Series B V14.103 firmware package.
https://compatibility.rockwellautomation.com/Pages/MultiProductFindDownloads.aspx?crumb=112&mode=3&refSoft=1&versions=61168

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.