CVE-2025-9064CWE-22CWE-287path-traversal

CVE-2025-9064

Critical · published October 14, 2025

CVSS v3.1
9.1
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

⚡ A crafty path traversal vulnerability in FactoryTalk View Machine Edition can let attackers delete any file on the system — no authentication needed! Imagine a delivery driver who knows exactly which packages to toss out without ever having to check in at the front desk — that's what this vulnerability allows. An attacker with knowledge of filenames can essentially walk right into the system and remove anything they want, just like that! An attacker on the same network could delete crucial files from the operating system, potentially crippling the functionality of the device. This could lead to system outages, data loss, and may even result in significant operational disruptions — a scenario that could be absolutely devastating for any organization dependent on the system!

Put simply

Imagine a delivery driver who knows exactly which packages to toss out without ever having to check in at the front desk — that's what this vulnerability allows. An attacker with knowledge of filenames can essentially walk right into the system and remove anything they want, just like that! This path traversal vulnerability in FactoryTalk View Machine Edition allows unauthenticated users to manipulate file paths and access files outside the intended directory, enabling them to delete files by knowing their names.

What to do

An attacker on the same network could delete crucial files from the operating system, potentially crippling the functionality of the device. This could lead to system outages, data loss, and may even result in significant operational disruptions — a scenario that could be absolutely devastating for any organization dependent on the system! To safeguard against this vulnerability, update FactoryTalk View Machine Edition to the latest version immediately. Additionally, restrict network access to trusted users only and monitor for any suspicious activity to mitigate the risks of exploitation. Taking these steps is essential to protect your system! You can tackle this issue! Follow the steps to secure your environment, and you'll strengthen your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00607 · 48.4th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-287 · Improper Authentication
Published
2025-10-14T17:15Z
Affected products (1)
ProductVersionsFixed in
rockwellautomation/factorytalk_view≤ 15.0—
References (1)
EPSS history
Timeline
  • 14 OCT 12:22Z
    Rockwell Automation FactoryTalk View Machine Edition Path Traversal
    cvelistv5