CVE-2025-0477
📋 TL;DR
A critical encryption vulnerability in Rockwell Automation FactoryTalk AssetCentre allows attackers to extract other users' passwords due to weak encryption methodology. All versions before V15.00.001 are affected, potentially compromising industrial control system security.
💻 Affected Systems
- Rockwell Automation FactoryTalk AssetCentre
📦 What is this software?
Factorytalk Assetcentre by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of FactoryTalk AssetCentre with credential theft leading to lateral movement across industrial networks, potential sabotage of industrial processes, and data exfiltration.
Likely Case
Unauthorized access to FactoryTalk AssetCentre with privilege escalation, credential harvesting, and potential access to connected industrial systems.
If Mitigated
Limited impact if strong network segmentation, access controls, and monitoring prevent exploitation attempts from reaching vulnerable systems.
🎯 Exploit Status
Weak encryption vulnerabilities typically have low exploitation complexity once the methodology is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V15.00.001
Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html
Restart Required: Yes
Instructions:
1. Download FactoryTalk AssetCentre V15.00.001 from Rockwell Automation. 2. Backup current configuration and data. 3. Install the update following vendor documentation. 4. Restart the system. 5. Verify successful installation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate FactoryTalk AssetCentre from untrusted networks and limit access to authorized users only.
Access Control Hardening
windowsImplement strict access controls, multi-factor authentication, and least privilege principles.
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from critical assets
- Enhance monitoring and logging for suspicious access attempts to FactoryTalk AssetCentre
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk AssetCentre version in application interface or Windows Programs and Features. If version is below V15.00.001, system is vulnerable.Check Version:
Check via FactoryTalk AssetCentre GUI or Windows Control Panel > Programs and FeaturesVerify Fix Applied:
Verify version shows V15.00.001 or higher in application interface or Windows Programs and Features.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to FactoryTalk AssetCentre
- Failed authentication attempts followed by successful access
- Unexpected credential changes or access
Network Indicators:
- Unusual network traffic to/from FactoryTalk AssetCentre ports
- Connection attempts from unauthorized IP addresses
SIEM Query:
source="FactoryTalk AssetCentre" AND (event_type="authentication" OR event_type="access") | stats count by src_ip, user