Rockwell 1783-NATR CVE-2025-7328

Exploitation requires network reachability to the 1783-NATR device's affected management/critical functions, which lack authentication entirely (CWE-306, PR:N) - no credentials, user interaction, or special configuration are needed once the interface is reachable. The realistic limiting factor is exposure, not authentication: as an industrial NAT router, the device is typically deployed inside segmented OT networks, so an attacker must first gain access to the network segment where the NATR management plane is reachable. Impact severity is also conditioned on the device's role - modifying NAT rules only disrupts communications that traverse this router, and recovery from admin account takeover is stated to require physical access to the device.

Signals conflict sharply and must be weighed together. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 9.9 and describes a remotely reachable, low-complexity, unauthenticated flaw (CWE-306, missing authentication on critical functions) with high confidentiality, integrity and availability impact plus subsequent-system availability impact (SA:H) - consistent with admin account takeover, denial-of-service, and NAT rule tampering on an industrial NAT router. Against that, EPSS is only 0.54% (44th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified, so there is no evidence of real-world exploitation despite the near-maximal CVSS. This is best read as a genuinely high-severity design flaw whose practical urgency is tempered by exposure: the 1783-NATR is an OT/industrial device that in well-segmented ICS networks should not be directly internet- or broadly-reachable, which likely explains the low EPSS (targeted-access opportunity rather than mass-scannable). Net: a real patch priority for operators of this specific hardware, but not a widespread internet-facing emergency - the AV:N rating assumes network reachability that proper ICS segmentation often removes, and that caveat should be verified against the actual deployment topology.

An attacker with network reachability to the 1783-NATR management interface invokes critical functions that lack authentication checks, taking over the admin account or rewriting NAT rules without credentials. This lets them cut the device off (denial-of-service), redirect device traffic to incorrect endpoints, or alter configuration - with admin takeover requiring physical access to recover. No public proof-of-concept is known, so exploitation would currently require independent development, though the low attack complexity makes that straightforward once the device is reachable.