SB2025013112 - Multiple vulnerabilities in Rockwell Automation FactoryTalk AssetCentre

Description

This security bulletin contains information about 3 vulnerabilities.

1) Inadequate Encryption Strength (CVE-ID: CVE-2025-0477)

CWE-ID: CWE-326 - Inadequate Encryption Strength

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a weak encryption methodology. A remote attacker can extract passwords belonging to other users of the application.

2) Insufficiently protected credentials (CVE-ID: CVE-2025-0497)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to storing credentials in the configuration file of EventLogAttachmentExtractor, ArchiveExtractor, LogCleanUp or ArchiveLogCleanUp packages. A local user can gain access to the target application.

3) Insufficiently protected credentials (CVE-ID: CVE-2025-0498)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to insecure storage of FactoryTalk Security user tokens. A local user can steal a token and impersonate another user.

Remediation

Install update from vendor's website.

References

• https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-05