ZDI-CAN-27055 HIGH 7.8 Overdue May 02, 2025

Rockwell Automation

Rockwell Automation, a major industrial control systems and manufacturing software vendor, has a high-severity local vulnerability that requires user interaction but delivers complete system compromise through confidentiality, integrity, and availability breaches. The flaw is locally exploitable without authentication, meaning an attacker with physical or local network access can trick a user into triggering the vulnerability to gain full system control. Security teams should monitor for exploitation attempts targeting manufacturing environments and ensure systems are updated once Rockwell releases a patch by the August 30, 2025 deadline.

Advisory Details
Researcher Discovered by: Rocco Calvi (@TecR0c) with TecSecurity
Reported May 02, 2025
Deadline August 30, 2025 229d overdue
CVSS Vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy