FactoryTalk Analytics PavilionX CVE-2025-14272

Exploitation requires network reachability to the PavilionX tenant's API surface and the ability to send crafted HTTP requests directly to administrative endpoints (user management, role management) rather than going through the web UI; per CVSS PR:N/UI:N no valid account or user interaction is needed. The AC:H rating implies non-default conditions - the attacker must know or enumerate the privileged endpoint routes, parameter names, and any tenant or session identifiers expected by the API, which is not trivially obtainable without prior reconnaissance or leaked client traffic. Limiting factors: PavilionX is a Rockwell-hosted SaaS, so customers whose tenants Rockwell has already remediated server-side cannot be exploited regardless of client configuration, and on-prem-style network segmentation does not apply because access is over the internet to Rockwell-controlled infrastructure.

Signals point to a serious but conditionally exploitable issue. The CVSS 4.0 vector AV:N/AC:H/AT:N/PR:N/UI:N indicates a network-reachable, unauthenticated attack but with high attack complexity, suggesting non-trivial conditions (e.g., knowledge of internal endpoint paths, request shapes, or tenant identifiers) must be met. Impact is asymmetric - VC:H with VI:L/VA:L - meaning data and account-control exposure is the principal risk rather than service disruption. There is no CISA KEV listing, no EPSS data supplied, and no public exploit identified at time of analysis, so this is not currently a mass-exploitation candidate; however, because PavilionX is a SaaS-style platform shared across customers, any successful exploitation could affect tenant isolation, making it a real priority for Rockwell customers despite the absence of public PoC. Key data gap: the advisory SD1777 is gated behind Rockwell's trust center and was not directly retrievable here, so exact fixed build numbers and any cloud-side mitigation already deployed by Rockwell could not be independently verified.

An attacker who can reach the PavilionX tenant URL crafts direct HTTP requests against the administrative API endpoints - for example, the role-assignment or user-creation route - bypassing the UI's authorization checks because the server does not re-validate the caller's role. They create a new administrator account, log in normally, and exfiltrate process-historian data and model parameters or pivot to alter analytics outputs feeding control decisions. No public exploit identified at time of analysis, but the attack requires discovery of endpoint paths and request shapes, consistent with the AC:H rating.