FactoryTalk Historian SE CVE-2025-13036

Exploitation requires network reachability to the FactoryTalk Historian SE login endpoint and the ability to issue many concurrent HTTP requests fast enough to win the race window in the authentication handler - no credentials, user interaction, or non-default configuration are needed (PR:N/UI:N against default deployments), but the AT:P attack-requirement and CWE-362 race nature mean exploitation is probabilistic rather than guaranteed and may fail under heavy server load or aggressive rate limiting. Limiting factors are therefore network exposure of the login endpoint (typically inside an OT/plant network rather than internet-facing) and the timing sensitivity of the race; the flaw is specific to FactoryTalk Historian Site Edition and does not require any particular optional feature to be enabled per the description.

Signals converge on a high-priority issue: CVSS 4.0 base of 9.2, AV:N/AC:L/PR:N/UI:N means a remote unauthenticated attacker can reach the login endpoint with low complexity, and successful exploitation yields high confidentiality and integrity impact on the historian (VC:H/VI:H) with limited availability impact (VA:L). The AT:P modifier tempers this slightly - exploitation is not deterministic and requires winning a timing race, which may need many requests and tuned network conditions. EPSS and KEV status were not provided, and no public POC has been observed, so widespread opportunistic exploitation is unlikely in the immediate term; however, the target population (OT/ICS data historians) is high-value and often network-exposed within plant networks, so the practical risk to operators is significant despite the race condition limiter. No conflicting signals were noted in the source data.

An attacker with network reach to the FactoryTalk Historian SE login endpoint - for example a foothold on the corporate IT network bridged to OT, or a misconfigured perimeter exposing the historian - fires a high-rate burst of concurrent login requests against the endpoint to win the race condition. One of the racing requests returns a valid authentication token despite no valid credentials being supplied, granting the attacker authenticated API access to query and tamper with historized process data. No public POC has been identified, but the attack pattern is straightforward to script with standard HTTP tooling.