FactoryTalk View CVE-2025-9064

Attacker must have network access to the same network segment as the FactoryTalk View Machine Edition panel (description states 'same network as the device,' suggesting adjacent/OT-network positioning despite the AV:N metric). No authentication is required (PR:N). The key limiting factor is that exploitation depends on prior knowledge of the exact filenames to be deleted - there is no implied directory enumeration, so blind deletion is not described. Impact is limited to file deletion (availability); no confidentiality or integrity compromise is indicated. Realistic risk is therefore bounded by OT network segmentation and the attacker's reconnaissance of valid filenames on the panel OS.

Signals are moderate and partly conflicting. The CVSS 4.0 base score of 8.7 (High) is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), reflecting that the flaw only permits arbitrary file deletion. The vector claims network reach (AV:N), low complexity (AC:L), and no privileges/interaction (PR:N/UI:N), which would normally justify urgency. However, the description explicitly scopes the attacker to 'the same network as the device,' implying adjacent/OT-segment access rather than true internet-facing exploitation - CVSS marks AV:N but the description implies adjacent network access, so verify reachability against your network segmentation. Exploitation is further gated by a real precondition: the attacker must know the exact filenames to delete, which lowers practical automatability. EPSS is low at 0.61% (47th percentile), there is no CISA KEV listing, and no public exploit was identified, so this is not evidence of active or widespread exploitation. Net: a legitimately high-impact availability bug in an ICS/OT product, but current threat-intel signals point to it being a patch-on-normal-cycle item rather than an emergency, especially where OT networks are properly segmented.

An attacker with a foothold on the same OT/control network as a FactoryTalk View Machine Edition HMI panel sends a crafted request exploiting the path traversal to delete a known operating-system or application file on the panel, with no authentication required. By removing a critical runtime or configuration file, the attacker can crash or render the HMI inoperable, disrupting operator visibility and control. No public exploit code was identified at time of analysis, and the attacker must know specific target filenames.