FactoryTalk Linx CVE-2025-9068

Exploitation requires the attacker to already hold valid low-privileged Windows user credentials and have local access to a host where the Rockwell Automation Driver Package is installed as part of FactoryTalk Linx. The specific trigger is the MSI repair functionality: the attacker must be able to initiate a package repair and then interactively hijack the console window spawned by the elevated vbpinstall.exe process. Limiting factors: no remote exploitation is possible (AV:L), prior authentication is mandatory (PR:L, so not usable by fully anonymous attackers), and the FactoryTalk Linx Driver Package must be installed on the target. There is no user-interaction requirement on a victim, which makes the escalation reliable once local access is obtained.

This is a local privilege-escalation flaw (CWE-269) in Rockwell Automation's Driver Package installed with FactoryTalk Linx. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms it requires local access and existing low-privileged Windows credentials, but once those are held, exploitation is low-complexity with no user interaction and yields full SYSTEM compromise (VC:H/VI:H/VA:H). The headline score of 8.5 reflects the total-takeover impact, not ease of remote reach - this is NOT a remotely exploitable, internet-facing issue. Supporting signals temper urgency: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active or widespread exploitation. The signals are internally consistent (low EPSS + no KEV + local vector all point to a serious-but-not-emergency privesc). Real-world priority is moderate: it matters most in OT/ICS environments where any authenticated foothold on a FactoryTalk Linx host must not be allowed to escalate to SYSTEM, but it is not a drop-everything remote-exploitation threat.

An attacker who already has a valid low-privileged Windows user account on a host running FactoryTalk Linx initiates a repair of the Rockwell Driver Package MSI. During the repair, they hijack the console window of the elevated vbpinstall.exe process and use it to launch a command prompt running as SYSTEM, gaining complete control of the machine. No public exploit code was identified, and exploitation requires prior local authenticated access, so this is a post-compromise escalation rather than an initial-access vector.