CVE-2025-24481 Rockwell Automation CVE debrief

Who should care

Industrial control system operators, OT administrators, and engineers who run Rockwell Automation FactoryTalk View Site Edition on Windows workstations, especially environments still on versions earlier than 15.0 or where Port 8091 is reachable from untrusted networks.

Technical summary

The advisory describes an incorrect permission assignment on the remote debugger port in FactoryTalk View Site Edition products before Version 15.0. The exposure can permit unauthenticated access to system configuration, making workstation hardening and network access restriction important even before remediation. The CSAF remediation guidance specifically calls out upgrading to V15.0 or applying the vendor patch, protecting physical access to the workstation, and restricting access to Port 8091 at the network or workstation.

Defensive priority

High. The advisory assigns a CVSS v3.1 score of 7.3 (High), and the vendor guidance indicates the vulnerable service exposure can affect system configuration. Prioritize this for OT/ICS environments where the product is deployed on shared or reachable engineering workstations.

Recommended defensive actions

• Upgrade FactoryTalk View Site Edition to Version 15.0 or apply the vendor patch referenced in the advisory (Answer ID 1152306).
• Restrict access to Port 8091 at the network boundary and on the workstation.
• Protect physical access to affected workstations.
• Validate the FactoryTalk View SE installation path and environment variables as recommended by Rockwell (Answer ID 1152304).
• Follow Rockwell Automation’s industrial control system security best practices and defense-in-depth guidance.
• Use stakeholder-specific vulnerability categorization (SSVC) to prioritize remediation in your environment.

Evidence notes

All substantive claims are taken from the supplied CISA CSAF advisory for ICSA-25-028-04 / CVE-2025-24481 and its included remediation entries. The advisory states the product scope as FactoryTalk View Site Edition versions prior to 15.0, the flaw type as incorrect permissions on the remote debugger port, and the impact as unauthenticated access to system configuration. The published date used here is 2025-01-28, matching the supplied CVE/source timeline. The provided corpus does not include KEV listing or ransomware campaign use, so none is asserted.

Official resources