A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can be abused to perform XXE, resulting in a temporary denial-of-service.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

-Panel View Plus 7 Standard and Panel View Plus 7 Performance Series A v12 ,v13, v14 patch AID BF30506 https://support.rockwellautomation.com/app/answers/answer_view/a_id/1150944/loc/en_US   (firmware fix)   -Panel View Plus 7 Performance Series B V14.103 https://compatibility.rockwellautomation.com/Pages/MultiProductFindDownloads.aspx

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1752html cve-icon cve-icon
History

Tue, 14 Oct 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Oct 2025 12:30:00 +0000

Type Values Removed Values Added
Description A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can be abused to perform XXE, resulting in a temporary denial-of-service.
Title Rockwell Automation FactoryTalk® ViewPoint XXE to Denial-of-Service Vulnerability
Weaknesses CWE-20
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Rockwell

Published:

Updated: 2025-10-14T18:44:50.355Z

Reserved: 2025-08-15T13:59:29.317Z

Link: CVE-2025-9066

cve-icon Vulnrichment

Updated: 2025-10-14T18:44:47.443Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-14T13:15:39.790

Modified: 2025-10-14T19:36:29.240

Link: CVE-2025-9066

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.