Critical Vulnerabilities in Rockwell Automation FactoryTalk: What You Need to Know

The cybersecurity landscape once again serves a potent reminder that even the most robustly engineered industrial systems can harbor significant vulnerabilities. If you're in the manufacturing or critical infrastructure sector and using Rockwell Automation FactoryTalk products, this one’s for you. Let's dive in and break down the recently identified vulnerabilities disclosed on January 28, 2025 by the Cybersecurity and Infrastructure Security Agency (CISA).

What’s at Risk? An Overview​

The vulnerabilities center on Rockwell Automation FactoryTalk, a suite of software products integral to many critical manufacturing processes. The affected products include:

• FactoryTalk: All versions prior to v15.0.
• FactoryTalk View SE: All versions prior to v15.0.

Think of FactoryTalk as the digital backbone of a factory’s operational control systems—software that helps manage automation and improve productivity. Now imagine that same backbone having exploitable weaknesses, and you can start to understand the gravity of the situation.

Vulnerability Highlights at a Glance​

• CVSS v4 Base Score: 7.0 (High severity)
• Type of Vulnerabilities:
• Incorrect Permission Assignment for Critical Resource (CWE-732)
• Improper Control of Generation of Code (‘Code Injection’) (CWE-94)
• Attack Complexity: Low (yikes, even amateurs could try their shot)
• Impacted Areas: System configuration files, ability to execute DLLs with elevated privileges.

The big takeaway? These vulnerabilities could allow malicious actors unauthenticated access to sensitive system settings and the ability to execute malicious code through DLL files, creating a potential nightmare for critical manufacturing sectors.

---

The Technical Lowdown: Decoding the Threat​

Here's where we geek out over the technicalities.

1. Incorrect Permission Assignment for Critical Resource (CWE-732)​

• CVE Identifier: CVE-2025-24481
• Description: Due to overly permissive access rights assigned to a remote debugging port, attackers—without even needing authenticated access—might tinker with critical system configurations.
• Impact: Think of someone wandering into a manufacturing control room and casually reprogramming your factory equipment. This flaw allows unauthorized access to systems, with potential escalation to modify operational behavior.
• CVSS v4 Vector: AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
• CVSS v3.1 Score: 7.3.

2. Improper Control of Code Generation (‘Code Injection’) (CWE-94)​

• CVE Identifier: CVE-2025-24482
• Description: This one involves improper handling of Dynamic-Link Libraries (DLLs), allowing malicious actors to execute arbitrary DLLs with escalated privileges. In simpler terms, it’s like letting someone sneak into your data center and plug in malware-infested USB drives.
• Impact: Successful exploitation can enable attackers to run rogue scripts and potentially disrupt automation workflows.
• CVSS v4 Vector: AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
• CVSS v3.1 Score: 7.3.

---

The Bigger Picture: Why It Matters​

Critical Infrastructure in the Crosshairs​

Perhaps the most concerning aspect is that this vulnerability is a direct threat to critical manufacturing—think power plants, food production facilities, and industrial AI systems. FactoryTalk is deployed worldwide, with its home base in the United States. The fallout from an exploit here doesn’t just hurt the company using FactoryTalk; it reverberates across supply chains, critical sectors, and even national security.

Why Update Metrics Like CVSS Matter​

The vulnerabilities have been scored using the Common Vulnerability Scoring System (CVSS), and highlighted scores show that while the vulnerabilities aren't directly exploitable over the internet, they require only low effort with a significant impact. For example, CVSS v4 introduces newer dimensions such as attack requirements (AT) and victim outcomes (VC, VI, VA) to paint a fuller picture.

The Stealth Factor​

Notably, CISA has confirmed that there are currently no publicly reported active exploits. However, the vulnerabilities need addressing given their potential for serious exploitation at workplaces.

---

What Should You Do? Mitigation Steps​

For FactoryTalk Environments:​

Rockwell Automation is on it, providing patches and upgrades. Here's what to do next:

• Upgrade to Version 15.0 or Apply the Patches:
• Find patches via Answer ID 1152306 and Answer ID 1152304 on the Rockwell Automation page.
• Lock Down Physical and System Access:
• Restrict Port 8091 at the network or workstation level to block unauthorized debugging.
• Protect physical workstations from unauthorized access.
• Control Environment Variables:
• Ensure PATH prioritizes FactoryTalk's installation folder (C:\Program Files (x86)\Common Files\Rockwell).

Apply CISA-Recommended Defensive Measures:​

The good folks at CISA suggest:

• Isolation is Key:
• Keep control system networks segmented and behind robust firewalls.
• Avoid exposing these systems directly to the internet.
• Remote Access Practices:
• Enable secure remote access using updated VPNs—but remember, a VPN is as secure as its weakest link (e.g., outdated endpoints).
• Risk Assessment:
• Conduct in-depth impact analysis before deploying defensive measures to ensure compatibility and avoid system disruptions.

Besides patching these vulnerabilities, organizations should implement a proactive defense strategy, tweaking and updating their broader cybersecurity posture regularly.

---

Did You Say Cyber-to-Factory Risks?!​

For those unfamiliar with industrial automation vulnerabilities, a potential exploit here doesn’t just cause routine inconvenience. It could stop manufacturing lines, alter the production of critical goods, or introduce sabotage in highly sensitive operations. One infected DLL or misconfigured port access could affect not just a single factory but entire networks, creating ripple effects.
With the increasing convergence of IT and OT (Operational Technology), cyber threats to factories aren’t hypothetical—they're happening. The best time to patch your systems is now. Ignoring this could introduce multiple attack vectors based on the vulnerabilities disclosed here.

---

Call to Action: Are You Ready?​

This isn’t just a patch-it-and-forget-it situation. It’s a wake-up call for everyone relying on FactoryTalk products to:

• Audit their security infrastructure,
• Secure their OT environments,
• But also apply a layered, defense-in-depth strategy.

For continued best practices, dive into resources like Industrial Control Systems | Cybersecurity and Infrastructure Security Agency CISA or peruse specific tips in ICS-TIP-12-146-01B for spotting cyber intrusions in industrial networks.
So, time to roll up your sleeves, squash those vulnerabilities, and keep your FactoryTalk systems crack-free!

---

Source: CISA Rockwell Automation FactoryTalk View Site Edition | CISA