CVE-2025-0497

criticalpriority · track · 39EPSS 0.003 · 26 %ileDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.33% (26th) EPSS
CVSS 9.8 · critical
Is it mine?
7 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to storing credentials in the configuration file of EventLogAttachmentExtractor, ArchiveExtractor, LogCleanUp, or ArchiveLogCleanUp packages.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedFactoryTalk AssetCentrecisa_csaf_ot

    For CVE-2025-0497: Update FactoryTalk AssetCentre to v15.00.01 or later. Apply patches to correct legacy versions: To apply the patch for LogCleanUp or ArchiveLogCleanUp, download and install the Rockwell Automation January 2025 monthly patch rollup, or later. To apply patches for EventLogAttachmentExtractor or ArchiveExtractor, locate the article BF31148, download the patch files and follow the instructions. Restrict physical access to the machine to authorized users.

    https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1153042
  • MitigationFactoryTalk AssetCentrecisa_csaf_ot

    Rockwell Automation recommends users follow the following mitigations:

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 4.4–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.17highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.17highAV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v4.07.3highCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.07.3highCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · PSIRT@rockwellautomation.com
v4.04.4mediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-522USCWE-522USCWE-522US
05

affected products (7)

Products and version ranges known to be affected.

06

advisories (2)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2025-0229Rockwell Automation FactoryTalk AssetCentre: Mehrere Schwachstellen ermöglichen Erlangen von BenutzerrechtenDeutsch2025-01-30csaf · cert_bundDE

    Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rockwell Automation FactoryTalk AssetCentre ausnutzen, um Benutzerrechte zu erlangen.

  • ICSA-25-030-05Rockwell Automation FactoryTalk AssetCentre2025-01-30icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could allow an attacker to extract passwords, access, credentials, or impersonate other users.

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundcisa_csaf_otnvdNVDCVE.orgMITRE
published 2025-01-30modified 2026-06-17
09

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan