# Rockwell FactoryTalk Linx improper access control flaw

Published: 2025-08-15 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/1eac1429-fbb6-5f56-8449-a196df2f9a02/rockwell-factorytalk-linx-improper-access-control-flaw

> Improper access control in FactoryTalk Linx before 6.50 allows local attackers to bypass token validation and modify drivers.

Rockwell Automation has disclosed a critical access control vulnerability in FactoryTalk Linx versions prior to 6.50. The flaw exists in the FactoryTalk Linx Network Browser component and can be exploited by modifying the process.env.NODE_ENV environment variable to 'development' mode, which disables FTSP token validation. An attacker with local access can leverage this bypass to create, update, and delete FTLinx drivers, potentially affecting the integrity of industrial control systems.

The vulnerability carries a CVSS v3.1 score of 9.0 and CVSS v4 score of 8.4, reflecting low attack complexity and local access requirements. The flaw is CWE-284 (Improper Access Control) and has been assigned CVE-2025-7972. No active exploitation in the wild has been reported to CISA at the time of publication. Affected organizations should prioritize upgrading to FactoryTalk Linx version 6.50 or later, and implement network segmentation and access controls to restrict local access to systems running this product.

Defensive measures include minimizing network exposure for control system devices, isolating ICS networks behind firewalls, and using VPNs for required remote access. Organizations unable to upgrade immediately should enforce additional security best practices and monitor for suspicious modifications to driver configurations.

## Mentioned in this report

- Vulnerabilities: CVE-2025-7972

## Detection guidance (public sample)

### NODE_ENV Set to Development in Persistent Environment Registry

ATT&CK: T1548

Persistent NODE_ENV=development environment variable written to the registry, the condition that disables FTSP token validation in vulnerable FactoryTalk Linx (CVE-2025-7972). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: NODE_ENV Set to Development in Persistent Environment Registry
description: Detects the NODE_ENV environment variable being set to development in
  the user or system Environment registry keys. In vulnerable FactoryTalk Linx versions
  (before 6.50, CVE-2025-7972) this setting disables FTSP token validation and allows
  unauthorised creation, update and deletion of FTLinx drivers. Most relevant on ICS/OT
  hosts running Rockwell software, where developer tooling is not expected. Matches
  the behaviour, not any specific host.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Environment\NODE_ENV
    Details|contains: development
  condition: selection
falsepositives:
- Developer workstations where Node.js developers persistently set NODE_ENV to development
- Build or CI agents configured with a development environment profile
level: medium
id: 8f61d3e4-e52d-5086-a948-0a83a38d310c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-24
```

### NODE_ENV Development Mode Set via Command Line

ATT&CK: T1548

Command line setting NODE_ENV to development through setx, set or PowerShell, consistent with the FactoryTalk Linx FTSP token validation bypass (CVE-2025-7972). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: NODE_ENV Development Mode Set via Command Line
description: Detects setx, cmd set or PowerShell commands that set the NODE_ENV environment
  variable to development. For vulnerable FactoryTalk Linx Network Browser (before
  6.50, CVE-2025-7972) this bypasses FTSP token validation, so a local attacker can
  modify FTLinx drivers. Triage on hosts running Rockwell FactoryTalk software.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
  category: process_creation
  product: windows
detection:
  selection_setx:
    Image|endswith: \setx.exe
    CommandLine|contains|all:
    - NODE_ENV
    - development
  selection_set:
    CommandLine|contains:
    - set NODE_ENV=development
    - set "NODE_ENV=development"
    - env:NODE_ENV='development'
    - env:NODE_ENV="development"
    - env:NODE_ENV = 'development'
    - env:NODE_ENV = "development"
  condition: 1 of selection_*
falsepositives:
- Node.js developers or build scripts setting NODE_ENV for local testing
- Software deployment scripts that configure Node-based applications in development
  mode
level: medium
id: 88ca6159-3978-5e3b-8b5b-4a15dafd3d94
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-24
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-24

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1eac1429-fbb6-5f56-8449-a196df2f9a02/rockwell-factorytalk-linx-improper-access-control-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup