# Rockwell FactoryTalk ViewPoint XML injection denial-of-service

Published: 2025-10-16 · Severity: routine · Sectors: manufacturing, energy, infrastructure, transportation
Canonical: https://vorant.io/reports/11fc5b35-654d-55fa-aaf1-0bf0cfcc380e/rockwell-factorytalk-viewpoint-xml-injection-denial-of-service

> Unauthenticated remote XML entity injection in Rockwell FactoryTalk ViewPoint causes temporary DoS; patch available.

A remote XML external entity (XXE) injection vulnerability in Rockwell Automation FactoryTalk ViewPoint allows unauthenticated attackers to trigger a denial-of-service condition via malformed SOAP requests. The flaw is tracked as CVE-2025-9066 with CVSS 8.7 and affects PanelView Plus 7 Terminal version 14 and prior. Attack requires no authentication, low complexity, and network accessibility.

The vulnerability poses risk to critical infrastructure operators across manufacturing, energy, food and agriculture, transportation, and water/wastewater sectors. Rockwell has released patched firmware versions: PanelView Plus 7 Standard/Performance Series A with patch AID BF30506, and Performance Series B v14.103. No public exploitation has been reported. Operators unable to patch immediately should isolate affected systems from internet-facing networks and implement network segmentation behind firewalls.

## Mentioned in this report

- Vulnerabilities: CVE-2025-9066

## Detection guidance (public sample)

### XML External Entity Payload in Web Request URI

ATT&CK: T1190

Detects DOCTYPE/ENTITY declarations in web request URIs or query strings, an XXE injection attempt against a public-facing web service such as a SOAP endpoint like FactoryTalk ViewPoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: XML External Entity Payload in Web Request URI
description: Detects XML DOCTYPE/ENTITY declarations (raw or URL-encoded) in the request
  URI or query string of web server logs. This indicates XXE injection attempts against
  public-facing XML/SOAP services, as in the FactoryTalk ViewPoint XXE denial-of-service
  flaw (CVE-2025-9066). Only catches payloads sent in the URL, not in POST bodies,
  so pair with WAF or body inspection where available.
tags:
- attack.initial-access
- attack.t1190
- attack.impact
- attack.t1499.004
logsource:
  category: webserver
detection:
  selection_entity:
    cs-uri-query|contains:
    - '!ENTITY'
    - '!DOCTYPE'
    - '%21ENTITY'
    - '%21DOCTYPE'
  selection_stem:
    cs-uri-stem|contains:
    - '!ENTITY'
    - '!DOCTYPE'
    - '%21ENTITY'
    - '%21DOCTYPE'
  condition: 1 of selection_*
falsepositives:
- Authorized vulnerability scanners or penetration tests probing for XXE
- Web applications that legitimately pass XML snippets in query strings (rare)
level: medium
id: 3fe6925d-9521-50c5-8d33-77a9450bd625
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-03
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/11fc5b35-654d-55fa-aaf1-0bf0cfcc380e/rockwell-factorytalk-viewpoint-xml-injection-denial-of-service.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup