Rockwell FactoryTalk ViewPoint XML injection denial-of-service
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unauthenticated remote XML entity injection in Rockwell FactoryTalk ViewPoint causes temporary DoS; patch available.
A remote XML external entity (XXE) injection vulnerability in Rockwell Automation FactoryTalk ViewPoint allows unauthenticated attackers to trigger a denial-of-service condition via malformed SOAP requests. The flaw is tracked as CVE-2025-9066 with CVSS 8.7 and affects PanelView Plus 7 Terminal version 14 and prior. Attack requires no authentication, low complexity, and network accessibility.
The vulnerability poses risk to critical infrastructure operators across manufacturing, energy, food and agriculture, transportation, and water/wastewater sectors. Rockwell has released patched firmware versions: PanelView Plus 7 Standard/Performance Series A with patch AID BF30506, and Performance Series B v14.103. No public exploitation has been reported. Operators unable to patch immediately should isolate affected systems from internet-facing networks and implement network segmentation behind firewalls.
Mentioned in this report
Detection guidance
XML External Entity Payload in Web Request URI
Detects DOCTYPE/ENTITY declarations in web request URIs or query strings, an XXE injection attempt against a public-facing web service such as a SOAP endpoint like FactoryTalk ViewPoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: XML External Entity Payload in Web Request URI
description: Detects XML DOCTYPE/ENTITY declarations (raw or URL-encoded) in the request
URI or query string of web server logs. This indicates XXE injection attempts against
public-facing XML/SOAP services, as in the FactoryTalk ViewPoint XXE denial-of-service
flaw (CVE-2025-9066). Only catches payloads sent in the URL, not in POST bodies,
so pair with WAF or body inspection where available.
tags:
- attack.initial-access
- attack.t1190
- attack.impact
- attack.t1499.004
logsource:
category: webserver
detection:
selection_entity:
cs-uri-query|contains:
- '!ENTITY'
- '!DOCTYPE'
- '%21ENTITY'
- '%21DOCTYPE'
selection_stem:
cs-uri-stem|contains:
- '!ENTITY'
- '!DOCTYPE'
- '%21ENTITY'
- '%21DOCTYPE'
condition: 1 of selection_*
falsepositives:
- Authorized vulnerability scanners or penetration tests probing for XXE
- Web applications that legitimately pass XML snippets in query strings (rare)
level: medium
id: 3fe6925d-9521-50c5-8d33-77a9450bd625
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-03
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs