Critical Rockwell NAT Router Flaw (CVE-2025-7328, CVSS 10.0) Allows Unauthenticated Admin Takeover

On 15 October 2025, Rockwell Automation warned about three vulnerabilities affecting its 1783-NATR NAT router, including a critical authentication bypass that could allow full administrative takeover. The flaws are tracked as CVE-2025-7328, CVE-2025-7329, and CVE-2025-7330, affect firmware version 1.006 and prior, and are fixed in version 1.007 and later.

The 1783-NATR is a configurable NAT router used to provide 1:1 IP address mapping between machine and control networks, a device widely deployed in industrial environments. According to Rockwell, the most severe flaw, CVE-2025-7328, carries a CVSS of 10.0 and stems from missing authentication checks on critical functions, potentially enabling denial of service, admin account takeover, or NAT rule modifications.

A stored XSS issue (CVE-2025-7329) could allow viewing or modifying sensitive data, while a CSRF flaw (CVE-2025-7330) could enable unintended configuration changes if a logged-in admin is lured to a crafted link. The advisory urges upgrading to firmware 1.007 or later and advises mitigations such as network segmentation and restricting access to trusted hosts.