CVE-2025-13036 Overview
CVE-2025-13036 is an authentication bypass vulnerability in Rockwell Automation FactoryTalk Historian Site Edition. The flaw allows a remote, unauthenticated attacker to obtain a valid authentication token by repeatedly sending requests to the login endpoint. The underlying weakness is a race condition [CWE-362] in the authentication logic.
The vulnerability carries a CVSS 4.0 base score of 9.2 and is network-accessible without privileges or user interaction. Successful exploitation grants attackers access to the Historian environment, exposing confidentiality and integrity of industrial process data.
Critical Impact
An unauthenticated network attacker can obtain valid authentication tokens for FactoryTalk Historian Site Edition by flooding the login endpoint, leading to full compromise of historian data.
Affected Products
- Rockwell Automation FactoryTalk Historian Site Edition
- Refer to Rockwell Automation Security Advisory SD1773 for affected version ranges
- Operational Technology (OT) environments using FactoryTalk Historian SE for process data collection
Discovery Timeline
- 2026-06-16 - CVE-2025-13036 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13036
Vulnerability Analysis
The vulnerability resides in the login endpoint of FactoryTalk Historian Site Edition. The authentication routine contains a race condition that an attacker triggers by continually sending login requests. Under sufficient request volume, the server issues a valid authentication token without verifying credentials correctly.
The EPSS score is approximately 0.28%, indicating low predicted exploitation activity at this time. However, the lack of required privileges or user interaction makes the flaw attractive to attackers with network access to the Historian server. FactoryTalk Historian is typically deployed in industrial environments to collect time-series process data from PLCs and SCADA systems.
Root Cause
The root cause is a concurrent execution flaw [CWE-362] within the authentication handler. Multiple simultaneous authentication requests reach a state where the token issuance code path executes before credential validation completes. This time-of-check to time-of-use gap allows an attacker to receive a session token tied to a valid account without ever presenting valid credentials.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker with network reachability to the Historian login endpoint scripts a high volume of concurrent or rapid-fire requests. Eventually, the race window produces a valid token, which the attacker then uses to query, alter, or exfiltrate historian data. No verified public proof-of-concept is currently available. See the Rockwell Automation Security Advisory for technical details.
Detection Methods for CVE-2025-13036
Indicators of Compromise
- High volume of authentication requests from a single source IP to the FactoryTalk Historian login endpoint within a short time window
- Successful authentication events with no preceding credential validation log entry
- Authentication tokens issued to source IPs outside the expected OT engineering workstation subnet
- Historian queries executed by sessions that do not correlate to a known operator or engineer login
Detection Strategies
- Monitor authentication logs for repeated POST requests to the Historian login endpoint exceeding baseline rates
- Correlate token issuance events with the source IP and account behavior to detect anomalous session creation
- Inspect network flows for unusual east-west traffic targeting Historian servers from non-engineering segments
Monitoring Recommendations
- Enable verbose authentication logging on FactoryTalk Historian SE and forward logs to a centralized SIEM
- Deploy network detection rules to alert on rapid login retry patterns against OT application servers
- Track session activity for newly issued tokens, flagging queries that retrieve unusually large historian datasets
How to Mitigate CVE-2025-13036
Immediate Actions Required
- Apply the security update referenced in Rockwell Automation Security Advisory SD1773 as soon as available
- Restrict network access to the FactoryTalk Historian login endpoint to authorized engineering workstations only
- Rotate all FactoryTalk Historian SE service and user account credentials after patching
- Review authentication and access logs for evidence of prior exploitation
Patch Information
Rockwell Automation has published advisory SD1773 covering CVE-2025-13036. Customers must consult the advisory for the fixed product version and apply the vendor-supplied update to remediate the race condition in the authentication handler.
Workarounds
- Place FactoryTalk Historian SE behind a firewall that enforces strict source IP allowlisting on the login endpoint
- Implement rate limiting and request throttling on the network path to the Historian server to disrupt race condition exploitation
- Segment the Historian server into a dedicated OT subnet following ISA/IEC 62443 zone and conduit guidance
- Disable remote access to the Historian login endpoint when not required for operations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
