FactoryTalk View ME CVE-2025-9063

Exploitation requires LOCAL access (AV:L) to the FactoryTalk View Machine Edition Web Browser ActiveX control on a PanelView Plus 7 Series B terminal, plus at least low existing privileges (PR:L) - it is NOT a remote, fully unauthenticated attack despite the 'authentication bypass' label. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific feature at risk is the embedded Web Browser ActiveX control; limiting factors are the need for local proximity/foothold and some privilege, so strong physical security and network segmentation of HMI devices materially reduce realistic exploitability.

This is a moderate-priority ICS/OT vulnerability whose signals are consistent but modest. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 7.0 (High) but is tempered by two factors: the attack vector is LOCAL (AV:L), not network, and the attacker needs at least low privileges (PR:L) - despite the vulnerability being classed as an authentication bypass (CWE-287). This is a notable internal tension: an 'authentication bypass' intuitively suggests pre-auth remote access, yet Rockwell's own vector requires local access plus some existing privilege, implying the bypass applies to a specific interface/function rather than granting cold remote entry - verify the exact access boundary with the vendor advisory (SD1753). Impact is skewed toward confidentiality (VC:H: file system, diagnostics, event logs) with lesser integrity (VI:L) and high availability (VA:H) impact, and no scope change to other systems (SC:N/SI:N/SA:N). EPSS is low at 0.39% (30th percentile), there is no CISA KEV listing, and no public exploit is indicated - so there is no evidence of widespread or imminent exploitation. Net: a legitimate patch-worthy flaw in deployed HMI hardware, but not an emergency compared to a network-facing pre-auth RCE; the local vector and OT context mean realistic risk depends heavily on physical/network segmentation of the HMI.

An attacker with local access and low-level privileges on or adjacent to a PanelView Plus 7 Series B terminal invokes the FactoryTalk View ME Web Browser ActiveX control to bypass authentication, gaining unauthorized access to the device file system, diagnostic data, and event logs. No public proof-of-concept is identified, and the local attack vector (AV:L) means the attacker must already have some foothold at or near the HMI rather than exploiting it over the open network.