CVE-2025-0477: FactoryTalk AssetCentre Info Disclosure

CVE-2025-0477 Overview

CVE-2025-0477 is a critical encryption vulnerability affecting Rockwell Automation FactoryTalk® AssetCentre, a centralized asset management solution widely deployed in industrial control system (ICS) environments. The vulnerability stems from a weak encryption methodology used to protect user credentials, allowing threat actors to extract passwords belonging to other users of the application.

This vulnerability poses significant risks to industrial environments where FactoryTalk AssetCentre manages critical automation assets. Successful exploitation could enable attackers to harvest credentials, potentially leading to lateral movement within industrial networks and unauthorized access to critical operational technology (OT) systems.

Critical Impact

Attackers can exploit weak encryption to extract user passwords, potentially compromising industrial control systems and enabling unauthorized access to critical automation infrastructure.

Affected Products

• Rockwell Automation FactoryTalk® AssetCentre versions prior to V15.00.001

Discovery Timeline

• 2025-01-30 - CVE-2025-0477 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-0477

Vulnerability Analysis

The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials), indicating that the application fails to adequately protect stored user credentials. The weak encryption methodology employed by FactoryTalk AssetCentre does not provide sufficient cryptographic strength to prevent credential extraction by malicious actors with access to the encrypted data.

In industrial environments, FactoryTalk AssetCentre serves as a centralized repository for managing automation assets, configurations, and backups. The application stores credentials for multiple users who interact with industrial control systems. The weak encryption implementation allows threat actors to decrypt these stored credentials, potentially gaining access to user accounts with varying privilege levels across the industrial network.

The network-accessible nature of this vulnerability means that remote attackers can potentially exploit this weakness without requiring prior authentication or user interaction, significantly expanding the attack surface in environments where FactoryTalk AssetCentre is network-accessible.

Root Cause

The root cause of this vulnerability lies in the implementation of an insufficiently robust encryption algorithm or methodology for protecting user credentials stored within FactoryTalk AssetCentre. This could involve the use of deprecated cryptographic algorithms, improper key management practices, or weak encryption key derivation that allows attackers to reverse the encryption and recover plaintext passwords.

Attack Vector

The attack vector is network-based, allowing remote exploitation. An attacker with network access to the FactoryTalk AssetCentre application can leverage the weak encryption methodology to extract stored user credentials. The exploitation does not require authentication or user interaction, making it particularly dangerous in environments where the application is exposed to broader network segments.

Once credentials are extracted, attackers can use them to authenticate as legitimate users, potentially gaining access to sensitive industrial automation systems, configuration data, and backup repositories managed by FactoryTalk AssetCentre.

Detection Methods for CVE-2025-0477

Indicators of Compromise

• Unusual database access patterns targeting credential storage locations within FactoryTalk AssetCentre
• Unexpected network connections to the FactoryTalk AssetCentre server from unauthorized hosts
• Authentication attempts using extracted credentials from unusual source IP addresses
• Anomalous queries or access to user credential tables within the application database

Detection Strategies

• Monitor FactoryTalk AssetCentre logs for unusual access patterns to credential-related data
• Implement network segmentation monitoring to detect unauthorized access attempts to ICS management systems
• Deploy intrusion detection signatures for known exploitation patterns targeting weak encryption vulnerabilities
• Audit authentication events for signs of credential abuse following potential extraction

Monitoring Recommendations

• Enable comprehensive logging for all FactoryTalk AssetCentre authentication and database access events
• Implement SIEM rules to correlate authentication failures with subsequent successful logins from different source addresses
• Monitor for bulk credential access patterns that may indicate systematic credential harvesting
• Establish baseline behavior for legitimate FactoryTalk AssetCentre operations to identify anomalies

How to Mitigate CVE-2025-0477

Immediate Actions Required

• Upgrade FactoryTalk AssetCentre to version V15.00.001 or later immediately
• Restrict network access to FactoryTalk AssetCentre servers to authorized hosts only
• Reset all user passwords stored within the application following the upgrade
• Review and audit user accounts for any signs of unauthorized access or privilege escalation

Patch Information

Rockwell Automation has released version V15.00.001 of FactoryTalk AssetCentre to address this vulnerability. Organizations should prioritize upgrading to this version or later to remediate the weak encryption issue. Detailed patch information and upgrade guidance is available in the Rockwell Automation Security Advisory SD1721.

Workarounds

• Implement strict network segmentation to isolate FactoryTalk AssetCentre from untrusted network segments
• Deploy additional authentication controls such as multi-factor authentication where supported
• Apply principle of least privilege by limiting user accounts to minimum necessary permissions
• Monitor and audit all access to the FactoryTalk AssetCentre system until patching is complete

# Network segmentation recommendation
# Restrict access to FactoryTalk AssetCentre to authorized management workstations only
# Example firewall rule (adapt to your environment)
iptables -A INPUT -p tcp --dport 443 -s <authorized_management_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP