Auth bypass in Rockwell Automation Factorytalk View Machine Edition
CVE-2025-9064
A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the panels operating system. Exploitation of this vulnerability is dependent on the knowledge of filenames to be deleted.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (47.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 47.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Rockwell Automation Factorytalk View Machine Edition — versions V15.00 and prior
- Rockwellautomation Factorytalk View
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-9064?
- CVE-2025-9064 is a critical-severity vulnerability in Rockwell Automation Factorytalk View Machine Edition, classified under Improper Authentication. CVSS score: 9.1/10. Published 2025-10-14.
- How severe is CVE-2025-9064?
- Critical severity. CVSS v3 base score is 9.1 out of 10.