FactoryTalk Linx
CVE-2025-9067
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with valid Windows credentials
-
ExploitTrigger FTLinx x86 MSI repair
-
ExecutionHijack resulting elevated console window
-
ImpactLaunch SYSTEM-level command prompt
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires FactoryTalk Linx installed via its x86 Microsoft Installer (MSI) package on a Windows host, plus valid Windows user credentials for an interactive (local) session, and the ability to initiate an MSI repair operation that produces a console window the attacker can hijack. Exploitation is limited by these factors: no remote vector (AV:L - attacker must be logged into the machine), authentication is required (PR:L - a valid low-privileged account is a prerequisite), and the target must have the vulnerable x86 MSI-installed build of FactoryTalk Linx present. No user interaction from a separate victim is needed (UI:N). |
| Impact | This is a local privilege-escalation flaw (CWE-269) in Rockwell Automation FactoryTalk Linx, and the signals are internally consistent but point to a moderate rather than urgent priority. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms the attacker must already have local access with valid Windows credentials (PR:L), so this is not a remote or unauthenticated issue despite the high 8.5 score; the high score is driven purely by the full VC:H/VI:H/VA:H impact of gaining SYSTEM. EPSS is low at 0.18% (7th percentile), there is no CISA KEV listing and no public exploit identified, which aligns with a local-only privesc that requires an existing foothold rather than a mass-exploitable network bug. The description and CVSS agree (both imply local, authenticated access), so there is no signal conflict here. Bottom line: genuine high technical impact once a foothold exists, but the local-access and authentication prerequisites plus low EPSS make this a prioritized-patch item rather than an emergency, especially outside the OT/ICS environments where FactoryTalk Linx runs. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged but valid Windows account on a host running FactoryTalk Linx initiates a repair of the x86 MSI package and hijacks the elevated console window that the repair spawns. From that window they launch a command prompt running as SYSTEM, gaining full control over files, processes, and system resources. No public exploit code was identified at time of analysis, and the local AV:L/AC:L vector means exploitation is straightforward once the attacker is logged in. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Local privilege escalation in Rockwell Automation FactoryTalk Linx allows an authenticated Windows user to obtain SYSTEM-level command execution by initiating a repair of the x86 MSI-installed package and hijacking the resulting console window. The attacker must have valid low-privileged Windows credentials and local/interactive access to the target host; no separate victim user interaction is required. No public exploit identified at time of analysis, no CISA KEV entry was provided, and EPSS is low at 0.18% (7th percentile), so this is assessed as a moderate-priority local privilege-escalation issue rather than an urgent exploited flaw.
RemediationAI
No exact fixed version is provided in the available intelligence; begin by consulting the Rockwell Automation advisory (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1754.html) for the vendor-recommended update or mitigation. If an updated FactoryTalk Linx package is available, upgrade to that version and, where operationally feasible, replace the x86 MSI installation with the vendor-supported build path. If no patch can be applied immediately, reduce local attack surface: limit interactive logon and local user rights on hosts running FactoryTalk Linx so only trusted administrators can sign in, and remove or disable unnecessary local accounts. Monitor for and alert on msiexec.exe repair actions (/f, /fa, /fv) involving FactoryTalk Linx followed by suspicious child processes such as cmd.exe or PowerShell running as SYSTEM; this is a detective control and does not prevent exploitation. Temporary hardening can also include restricting Windows Installer repair functionality via Group Policy or AppLocker/WDAC rules that block command-shell execution from MSI repair processes, but these controls can break software installation, repair, and update workflows and should be tested before broad deployment.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-269 (Improper Privilege Management) in the Windows Installer (MSI) repair process for Rockwell Automation FactoryTalk Linx, specifically the x86 MSI package. Windows Installer repair operations can invoke elevated functionality; here, an authenticated local user can trigger a repair and then hijack a console window that is created with SYSTEM-level privileges. The supplied CPE is cpe:2.3:a:rockwellautomation:factorytalk_linx:*:*:*:*:*:*:*:* (wildcard version), and the CVSS 4.0 vector is CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; the independent assessment maps this to CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Both vectors agree the issue is local, requires low privileges, requires no user interaction from a separate victim, and can fully compromise confidentiality, integrity, and availability of the host. EPSS is 0.18% (7th percentile), and no KEV or public exploit data supports active exploitation.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local interactive access with an existing low-privileged Windows account drives AV:L and PR:L; the MSI-repair console hijack is reliable (AC:L) and yields SYSTEM, giving full C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (rockwellautomation).
CVSS VectorVendor: rockwellautomation
DescriptionCVE.org
A security issue exists within the x86 Microsoft Installer File (MSI), installed with FTLinx. Authenticated attackers with valid Windows user credentials can initiate a repair and hijack the resulting console window. This allows the launching of a command prompt running with SYSTEM-level privileges, allowing full access to all files, processes, and system resources.
Executive ViewAI
A local privilege-escalation flaw in Rockwell Automation FactoryTalk Linx, the communications layer used across FactoryTalk View and Studio 5000 deployments, allows anyone holding valid low-privileged Windows credentials on an engineering workstation or HMI server to escalate to SYSTEM-level command execution. Because these hosts sit inside industrial control networks, a successful escalation gives an attacker the highest level of authority on the very machines that configure and monitor plant operations, creating a credible path to disruption or manipulation of production environments. This is a moderate-priority exposure rather than an emergency: no public exploit has been identified, EPSS is low, and no vendor fix is yet available, so leadership attention should focus on containing local-access risk while a patch is awaited.
No vendor-released patch identified at time of analysis. Exploitation status: no public exploit identified at time of analysis. Interim mitigations: restrict and audit local interactive logon on FactoryTalk Linx hosts; enforce least privilege by removing unnecessary local administrative rights; deploy application allowlisting to prevent unapproved MSI repair/install activity and console-window hijacking; enable EDR and process-level logging on installer and console activity; segment OT engineering workstations from general corporate networks; and monitor the Rockwell Automation advisory for a fix so it can be applied immediately upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
GitHub PoC
Exploit-DB