Rockwell 1783-NATR CVE-2025-7329

Exploitation requires the attacker to already hold administrative credentials to the 1783-NATR web management interface, because the malicious payload must be written into configuration fields that are 'behind admin login' (reflected as PR:H). A second condition is user interaction (UI:P): another user/administrator must subsequently load the page that renders the stored, unsanitized value for the script to execute. The vulnerable mechanism is a specific set of configuration input fields that lack special-character filtering and output encoding. Limiting factors: the admin-authentication gate, the dependency on a victim viewing the affected page, and the fact that impact is confined to the browser session of management-UI users rather than the device OS directly - making mass or unauthenticated exploitation infeasible.

This is a genuine but lower-priority issue - a high CVSS 4.0 base score (8.5) that does not translate into high real-world urgency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H) explicitly requires high privileges (PR:H) - i.e., an authenticated administrator - plus victim user interaction (UI:P), both of which sharply constrain exploitability. These signals align with the description, which states exploitation requires an attacker 'to be able to update configuration fields behind admin login,' confirming this is a post-authentication, admin-gated stored XSS rather than an unauthenticated RCE-grade flaw. The EPSS score is low (0.26%, 16th percentile), consistent with no exploitation interest. There is no CISA KEV listing and no public POC identified, so exploitation status is 'no public exploit identified at time of analysis.' Note a tension worth flagging: the vendor rates confidentiality/integrity/availability all High (VC:H/VI:H/VA:H) for what is fundamentally a stored XSS against other admin users - this is an aggressive impact rating; realistic impact for reflected/stored XSS in an admin console is typically session/credential theft and UI manipulation scoped to the browser context, so the raw 8.5 likely overstates true severity for most deployments.

An attacker who has already obtained administrative access to the 1783-NATR management interface injects a malicious script into a configuration field that lacks special-character filtering and output encoding. When another administrator later opens the page rendering that stored value, the script executes in their browser session, allowing theft of session data, modification of displayed settings, or denial of the management UI. No public exploit code is available, and the attack requires both existing admin privileges (PR:H) and a second user viewing the page (UI:P).