CVE-2025-0497 HIGH

CVE-2025-0497: Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability

Vendor Rockwell Automation
Product FactoryTalk® AssetCentre
Weakness CWE-522 · Insufficiently protected credentials
Published January 30, 2025
Last update February 12, 2025
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to storing credentials in the configuration file of EventLogAttachmentExtractor, ArchiveExtractor, LogCleanUp, or ArchiveLogCleanUp packages.

Key dates

02Disclosure timeline

January 30, 2025 CVE published
February 12, 2025 Record updated