PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-0498 Rockwell Automation CVE debrief

CVE-2025-0498 is a high-severity data exposure issue in Rockwell Automation FactoryTalk AssetCentre. In versions prior to V15.00.001, FactoryTalk Security user tokens were stored insecurely, which could allow a threat actor to steal a token and impersonate another user. CISA published the advisory on 2025-01-30 under ICSA-25-030-05.

Vendor
Rockwell Automation
Product
FactoryTalk AssetCentre
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-01-30
Original CVE updated
2025-01-30
Advisory published
2025-01-30
Advisory updated
2025-01-30

Who should care

Industrial control system administrators, Rockwell Automation customers, OT/ICS security teams, and anyone responsible for FactoryTalk AssetCentre deployments prior to V15.00.001 should prioritize this issue.

Technical summary

The advisory states that FactoryTalk AssetCentre versions before V15.00.001 insecurely stored FactoryTalk Security user tokens. If an attacker can access those tokens, the impact includes impersonation of another user. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access and user interaction are relevant to exploitation conditions, with high confidentiality, integrity, and availability impact once abuse occurs.

Defensive priority

High. The vulnerability is rated 7.8 (HIGH), affects a widely used OT/ICS product, and can enable identity impersonation. Remediation should be prioritized for any deployment running a vulnerable version.

Recommended defensive actions

  • Update FactoryTalk AssetCentre to v15.00.001 or later.
  • For legacy versions, apply the Rockwell Automation January 2025 monthly patch rollup or later as directed in the advisory.
  • Restrict physical access to the machine to authorized users, per vendor guidance.
  • Review and follow Rockwell Automation's security best practices for industrial automation control systems.
  • Verify which systems are running FactoryTalk AssetCentre prior to v15.00.001 and schedule remediation promptly.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-030-05 and the embedded vendor remediation notes. The advisory describes insecure storage of FactoryTalk Security user tokens in FactoryTalk AssetCentre versions before V15.00.001 and recommends upgrading to v15.00.001 or later, or applying the January 2025 monthly patch rollup for legacy versions. The CVSS vector provided in the source data is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. No KEV entry was supplied in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-0498 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-0498

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-0498 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-0498

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-030-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.