FactoryTalk ViewPoint CVE-2025-9066

Exploitation requires network reachability to the FactoryTalk ViewPoint SOAP web service interface, which must process attacker-supplied XML; the vulnerable path is triggered by 'certain SOAP requests' that abuse XML external entity parsing. No authentication is required (PR:N) and no user interaction is needed (UI:N), so default configurations exposing the SOAP endpoint are at risk. The practical limiting factor is exposure: FactoryTalk ViewPoint is an OT/ICS HMI typically segmented on plant networks, so reachability usually depends on the SOAP interface being accessible to the attacker (e.g., flat networks, internet exposure, or an already-compromised adjacent host). Impact is bounded to a temporary, recoverable denial-of-service - not data disclosure or code execution.

Signals are largely consistent and point to a moderate-priority, availability-only issue rather than a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack, which drives the 8.7 'High' score - but note that the entire score is carried by VA:H (availability), with VC:N and VI:N meaning no confidentiality or integrity impact despite XXE's usual data-exfiltration potential; the description explicitly limits the outcome to a 'temporary denial-of-service,' so the real-world impact is service disruption, not data theft or code execution. EPSS is low at 0.46% (38th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced, so there is no evidence of active or imminent widespread exploitation. The apparent tension is that a DoS-only flaw earns a High CVSS largely because of the easy unauthenticated network vector; defenders should weight it as a patch-in-normal-cycle item unless the affected FactoryTalk ViewPoint instances are internet-exposed or business-critical OT HMIs, in which case the temporary outage of operator visibility could matter more than the CVSS suggests.

A remote, unauthenticated attacker who can reach the FactoryTalk ViewPoint SOAP web interface sends a specially crafted SOAP request containing malicious XML external entity (XXE) definitions. The XML parser attempts to resolve the entities, exhausting resources or crashing the service and causing a temporary denial-of-service that disrupts operator access to the HMI. No public exploit code was identified at time of analysis, though XXE against SOAP endpoints is a well-understood and easily reproduced technique.