CVE-2025-9064: FactoryTalk View Path Traversal Flaw

CVE-2025-9064 Overview

A path traversal security vulnerability has been identified in Rockwell Automation FactoryTalk View Machine Edition, a widely deployed Human-Machine Interface (HMI) software used in industrial control system (ICS) environments. This vulnerability allows unauthenticated attackers on the same network as the affected device to delete arbitrary files within the panel's operating system. The attack requires knowledge of specific filenames to be targeted for deletion, but successful exploitation could result in significant operational disruption to industrial processes.

Critical Impact

Unauthenticated network-based attackers can delete arbitrary files on FactoryTalk View Machine Edition panels, potentially causing denial of service or disrupting critical industrial operations.

Affected Products

• Rockwell Automation FactoryTalk View Machine Edition (all versions prior to patch)
• Industrial control panels running FactoryTalk View Machine Edition
• HMI systems deployed with vulnerable FactoryTalk View configurations

Discovery Timeline

• October 14, 2025 - CVE-2025-9064 published to NVD
• October 28, 2025 - Last updated in NVD database

Technical Details for CVE-2025-9064

Vulnerability Analysis

CVE-2025-9064 is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal) and CWE-287 (Improper Authentication). The vulnerability exists within the file handling mechanisms of FactoryTalk View Machine Edition, where insufficient validation of user-supplied path parameters allows attackers to traverse outside intended directory boundaries.

The path traversal condition enables an attacker to manipulate file path inputs using sequences such as ../ to navigate to parent directories and target files anywhere on the underlying operating system. Combined with the authentication bypass weakness (CWE-287), the attack can be executed by any unauthenticated user with network access to the vulnerable device.

The primary impact of this vulnerability is high availability loss, as critical system or application files can be deleted, rendering the HMI panel inoperable. While direct confidentiality and integrity impacts are not observed through this specific attack vector, the deletion of configuration files, logs, or system binaries could have cascading effects on industrial operations.

Root Cause

The root cause of this vulnerability lies in improper input validation within the file deletion functionality of FactoryTalk View Machine Edition. The application fails to properly sanitize or validate path parameters before processing file deletion requests, allowing directory traversal sequences to escape the intended directory scope. Additionally, the affected functionality lacks proper authentication controls, enabling any network-adjacent attacker to invoke the vulnerable operation without credentials.

Attack Vector

The attack vector for CVE-2025-9064 is network-based, requiring the attacker to be on the same network segment as the vulnerable FactoryTalk View Machine Edition device. The attack has low complexity requirements—no user interaction is needed, and no prior authentication is required.

An attacker would craft malicious requests containing path traversal sequences targeting specific files on the panel's operating system. The exploitation is limited by the attacker's knowledge of filenames and their locations on the target system. However, attackers familiar with Windows file structures or FactoryTalk View installation paths could systematically target critical system files or application components.

The attack mechanism involves submitting file path parameters that include traversal sequences (e.g., ..\..\..\..\Windows\System32\targetfile.dll) to escape the application's working directory and reach arbitrary file system locations. See the Rockwell Automation Security Advisory for complete technical details.

Detection Methods for CVE-2025-9064

Indicators of Compromise

• Unexpected file deletion events in FactoryTalk View Machine Edition installation directories or system folders
• Network traffic containing path traversal sequences (../, ..\) targeting FactoryTalk View services
• Application or system errors related to missing files or corrupted configurations on HMI panels
• Unauthorized network connections to FactoryTalk View Machine Edition from unexpected sources

Detection Strategies

• Deploy network intrusion detection systems (IDS) with signatures for path traversal patterns in FactoryTalk View protocol traffic
• Monitor file system integrity on FactoryTalk View panels using file integrity monitoring (FIM) solutions
• Implement network segmentation monitoring to detect unauthorized access attempts to ICS/HMI network segments
• Enable verbose logging on FactoryTalk View systems and forward logs to a SIEM for anomaly detection

Monitoring Recommendations

• Establish baseline network behavior for FactoryTalk View devices and alert on deviations
• Configure alerts for file deletion events on critical system paths within HMI panels
• Monitor for authentication failures and unauthenticated access attempts to FactoryTalk View services
• Implement periodic file system snapshots to detect unauthorized modifications or deletions

How to Mitigate CVE-2025-9064

Immediate Actions Required

• Apply the security patch from Rockwell Automation as described in advisory SD1753 immediately
• Isolate FactoryTalk View Machine Edition devices from untrusted network segments pending patching
• Implement strict network access controls limiting connectivity to authorized management systems only
• Review and restrict network access to industrial control system (ICS) networks using firewalls and VLANs

Patch Information

Rockwell Automation has released a security advisory (SD1753) addressing this vulnerability. Organizations should consult the Rockwell Automation Security Advisory for specific patch versions and update instructions. Apply the recommended firmware or software updates to all affected FactoryTalk View Machine Edition installations during scheduled maintenance windows to minimize operational impact.

Workarounds

• Implement network segmentation to isolate HMI panels from general corporate networks and limit lateral movement opportunities
• Deploy application-layer firewalls or web application firewalls (WAF) capable of filtering path traversal patterns in requests
• Restrict network access to FactoryTalk View panels using access control lists (ACLs) permitting only authorized management stations
• Consider implementing additional authentication mechanisms at the network level (e.g., 802.1X) for devices accessing ICS segments

# Network segmentation example using firewall rules
# Restrict access to FactoryTalk View panels (example IP range 10.10.50.0/24)
# Allow only authorized engineering workstations (10.10.10.50-55)

iptables -A INPUT -s 10.10.10.50/32 -d 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -s 10.10.10.51/32 -d 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -s 10.10.10.52/32 -d 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -d 10.10.50.0/24 -j DROP