High-Severity Rockwell Flaws Risk Industrial SQLi Data Tampering and Safety Device DoS Requiring Manual Fix

Rockwell Automation has issued security advisories for two major flaws affecting its industrial cloud platform and safety communications hardware.

The most severe vulnerability, CVE-2025-12807, is in FactoryTalk DataMosaix Private Cloud and carries a high CVSS of 8.8, enabling SQL injection that could let users bypass normal privileges and perform sensitive database operations via exposed API endpoints; affected are DataMosaix Private Cloud versions 7.11, 8.00 and 8.01, with a remediation urging an upgrade to version 8.01.02.

The second advisory concerns the 432ES-IG3 Series A GuardLink EtherNet/IP Interface, identified as CVE-2025-9368 (CVSS 7.5), a Denial-of-Service flaw that can paralyse the device and cannot be fixed remotely, requiring a manual power cycle to recover once compromised; affected software version is 1.001, with remediation in version 2.001.9. If left unpatched, these flaws could allow data tampering or safety device downtime, potentially demanding manual intervention to restore operations.

According to the Rockwell advisory SD1765, a security issue in DataMosaix Private Cloud was disclosed, highlighting the risk to OT and IT data access across enterprises. Industrial operators should prioritise updates to prevent data tampering or operational downtime.