Rockwell Automation Patches Privilege Escalation and Denial-of-Service Flaws Across FactoryTalk and ArmorStart Systems

Rockwell Automation has released a series of advisories addressing vulnerabilities across FactoryTalk and ArmorStart products, discovered through internal testing, which could allow attackers to gain SYSTEM-level privileges, delete critical files, or trigger denial-of-service conditions in industrial environments.

The most severe issues affect FactoryTalk Linx, with two vulnerabilities—CVE-2025-9067 and CVE-2025-9068—centred on improper repair handling in MSI files that ship with Linx; authenticated attackers with Windows credentials can initiate an MSI repair and hijack the console window to spawn a SYSTEM-level command prompt, potentially granting full access to files, processes and resources, according to Rockwell Automation.

FactoryTalk View Machine Edition faces a path traversal flaw (CVE-2025-9064) that could let unauthenticated attackers on the same network delete arbitrary files, while another ME flaw (CVE-2025-9063) could permit authentication bypass via the Web Browser ActiveX control. Additional issues include CVE-2025-9066 in FactoryTalk ViewPoint, an XXE vulnerability leading to a temporary DoS, and CVE-2025-9437 in ArmorStart AOP that can crash the software through invalid COM method input. Rockwell also notes best practices such as network segmentation and restricting access to engineering workstations to mitigate these risks.