FactoryTalk Historian ME EUVD-2025-210818

Exploitation requires two concrete prerequisites: (1) the attacker must have adjacent network access - physically or logically residing on the same OT network segment, VLAN, or subnet as the FactoryTalk Historian service, ruling out internet-based exploitation; and (2) the attacker must possess at minimum low-privilege credentials valid for the historian service, as indicated by PR:L in the CVSS 4.0 vector - unauthenticated exploitation is not supported by the available data. No user interaction is required once the attacker is positioned and authenticated (UI:N). No specific non-default configuration or additional product feature is identified in the available data as a prerequisite beyond the service being network-reachable. Exploitation is limited by: the adjacency requirement (presupposing prior network access to an OT segment typically isolated from the internet); and the credential requirement (which assumes some level of credential compromise or insider access). These factors confine realistic exploitation to insiders, OT contractors, or post-breach lateral movement scenarios.

The CVSS 4.0 score of 8.6 is driven by low attack complexity, no required attack prerequisites, low privilege requirement, and full CIA impact on the vulnerable component. The AV:A (Adjacent Network) constraint is the primary risk moderator: exploitation is not possible from the public internet and requires the attacker to already occupy the same OT network segment, VLAN, or broadcast domain as the historian. In practice this means the threat actors most likely to succeed are insiders, contractors with OT access, or external attackers who have already breached the IT/OT boundary. Once on the adjacent segment, exploitation is straightforward - AC:L and AT:N indicate no race conditions, no special timing, and no uncommon configuration required. The combination of low privilege threshold and full RCE capability raises the effective priority: even operators without dedicated OT security resources should treat patching as urgent given how quickly a low-complexity, network-adjacent RCE can be weaponized post-breach. No KEV listing and no identified POC reduce the probability of opportunistic exploitation at this time, but ICS historians are high-value targets for both espionage (process data exfiltration) and sabotage (record tampering affecting compliance and safety review). EPSS data is not present in the available input.

An attacker who has gained a foothold on the OT network - for example, through a compromised engineering workstation or insufficient IT/OT boundary controls - authenticates to the FactoryTalk Historian service using a low-privilege account obtained from the environment. The attacker sends a specially crafted network request designed to overflow a buffer in the historian's input processing routine, corrupting adjacent memory structures and redirecting execution flow to attacker-controlled shellcode. This achieves remote code execution under the historian process's privilege context, enabling data exfiltration, manipulation of historical records, or use of the historian host as a pivot point for deeper OT network compromise.