CVE-2025-9036 HIGH

CVE-2025-9036: Rockwell Automation FactoryTalk® Action Manager v1.0.0 Runtime Vulnerability

Vendor Rockwell Automation
Product FactoryTalk® Action Manager
Weakness CWE-200 · Info exposure
Published August 14, 2025
Last update August 14, 2025
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and can be intercepted by any local client listening on the connection.

Key dates

02Disclosure timeline

August 14, 2025 CVE published
August 14, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-4523 IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function CVE-2025-11997 Document Pro Elementor – Documentation & Knowledge Base <= 1.0.9 - Unauthenticated Information Exposure CVE-2021-32712 Information leakage in Error Handler CVE-2025-4536 Gosuncn Technology Group Audio-Visual Integrated Management Platform listByPage information disclosure CVE-2021-22892