CVE-2025-9161
📋 TL;DR
This vulnerability in FactoryTalk Optix MQTT broker allows remote attackers to load malicious Mosquito plugins due to insufficient URI sanitization, leading to remote code execution. It affects industrial control systems using vulnerable versions of FactoryTalk Optix software.
💻 Affected Systems
- FactoryTalk Optix
📦 What is this software?
Factorytalk Optix by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the industrial control system, potentially disrupting operations or causing physical damage.
Likely Case
Remote code execution allowing data theft, system manipulation, or lateral movement within the industrial network.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to the MQTT broker.
🎯 Exploit Status
Exploitation requires network access to the MQTT broker but no authentication. Attackers need to craft malicious plugin URIs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.6.0 or later
Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1742.html
Restart Required: Yes
Instructions:
1. Download FactoryTalk Optix version 1.6.0 or later from Rockwell Automation. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart the system.
🔧 Temporary Workarounds
Network Segmentation
allIsolate FactoryTalk Optix systems from untrusted networks and internet
Disable MQTT Broker
windowsDisable MQTT broker functionality if not required
🧯 If You Can't Patch
- Implement strict network access controls to limit connections to the MQTT broker
- Monitor for unusual network traffic to/from the FactoryTalk Optix system
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk Optix version in application settings or control panel. Versions below 1.6.0 are vulnerable.Check Version:
Check via FactoryTalk Optix application interface or Windows Programs and FeaturesVerify Fix Applied:
Verify version is 1.6.0 or higher and test MQTT broker functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Unusual MQTT connection attempts
- Failed plugin loading attempts
- Unexpected process execution
Network Indicators:
- Unusual traffic to MQTT broker port (typically 1883)
- External connections to internal MQTT broker
SIEM Query:
source_ip=external AND dest_port=1883 AND dest_ip=FactoryTalk_Optix_IP