Rockwell FactoryTalk Historian flaws enable auth bypass, DoS
Three vulnerabilities in Rockwell Automation FactoryTalk Historian Site Edition allow authentication bypass via race condition and authenticated denial-of-service attacks against critical manufacturing systems.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA disclosed three vulnerabilities affecting Rockwell Automation FactoryTalk Historian Site Edition version 11 and earlier, deployed in critical manufacturing environments worldwide. CVE-2025-13036 is an authentication bypass stemming from a race condition that allows attackers to obtain valid authentication tokens by repeatedly sending requests to the login endpoint. CVE-2025-44019 and CVE-2025-36539 are uncaught exception vulnerabilities that permit authenticated users to crash PI Data Archive subsystems, resulting in denial of service and potential data loss from snapshots or write cache.
Rockwell Automation has released patch BF32850 for CVE-2025-13036 and recommends monitoring and automatic restart configuration for the DoS vulnerabilities. Workarounds include restricting port 5450 access to trusted systems and implementing PI System security best practices. No public exploitation has been reported to CISA at this time. The vulnerabilities impact industrial control systems in critical manufacturing sectors, requiring prompt remediation by affected organizations.
Mentioned in this report
Detection guidance
Repeated Authentication Requests to PI Data Archive Login Endpoint (Possible Race-Condition Auth Bypass)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects bursts of connection attempts to the FactoryTalk Historian / PI Data Archive service port (5450) consistent with the CVE-2025-13036 race-condition token theft technique. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Connections to PI Data Archive Service Port
id: d4d703ae-df70-56f4-8856-ba408703d4af
status: experimental
description: 'Detects multiple rapid connection attempts to TCP/5450, the FactoryTalk
Historian/PI Data Archive service port. CVE-2025-13036 allows an attacker to bypass
authentication by repeatedly sending login requests to trigger a race condition
and obtain a valid token. A high volume of short-lived connections from a single
source to this port in a short window is indicative of this exploitation attempt;
correlate with connection-rate thresholds in your SIEM (e.g. >20 connections from
one source within 60 seconds) as this cannot be expressed natively in Sigma.
'
references:
- https://www.cisa.gov/news-events/ics-advisories
author: Vorant
tags:
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 5450
Initiated: 'true'
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Legitimate PI System client applications polling the Historian service frequently
- Load balancers or health-check monitors probing the service port
level: medium
Anomalous Connection Volume to PI Data Archive Service Port (Potential DoS)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects an unusual spike of connections/traffic to the PI Data Archive service port 5450 that may indicate an attempt to exploit uncaught exception DoS vulnerabilities (CVE-2025-44019, CVE-2025-36539). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: High Volume Traffic to PI Data Archive Port 5450
id: d2d11546-35b6-52f1-bc23-6b82260851ee
status: experimental
description: 'Detects network traffic targeting TCP/5450 (PI Data Archive / FactoryTalk
Historian). Uncaught exception vulnerabilities (CVE-2025-44019, CVE-2025-36539)
can be triggered by sending crafted authenticated requests that crash the subsystem,
causing denial of service. A sustained increase in connections or repeated reconnections
to this port from authenticated or unauthenticated sources may indicate exploitation
attempts; apply a rate/count threshold (e.g. connection bursts exceeding baseline
by 3x within 5 minutes) in the SIEM correlation layer since Sigma cannot express
aggregation thresholds.
'
references:
- https://www.cisa.gov/news-events/ics-advisories
author: Vorant
tags:
- attack.t1498
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 5450
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Normal historian client polling from multiple engineering workstations
- Scheduled batch data collection jobs connecting to the archive service
level: medium
PI Data Archive Subsystem Crash Event Following Client Request
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Windows Application Error / crash events for PI Data Archive related processes, which may indicate successful exploitation of an uncaught exception DoS vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PI Data Archive Process Crash Logged in Windows Application Event Log
id: 5c7bd7f5-25f6-5bc3-afa6-0ced41c3030c
status: experimental
description: 'Detects application crash/error events for PI Data Archive or related
FactoryTalk Historian subsystem processes recorded in the Windows Application event
log. CVE-2025-44019 and CVE-2025-36539 allow authenticated attackers to send crafted
requests that trigger uncaught exceptions, crashing the service and causing data
loss and denial of service.
'
references:
- https://www.cisa.gov/news-events/ics-advisories
author: Vorant
tags:
- attack.t1498
logsource:
product: windows
service: application
detection:
selection:
Provider_Name: Application Error
EventID: 1000
keyword_filter:
Data|contains:
- pisubsys
- pinetmgr
- piarchss
- FactoryTalk Historian
condition: selection and keyword_filter
falsepositives:
- Unrelated third-party application crashes sharing generic Application Error event
ID
- Crashes caused by legitimate software bugs or resource exhaustion unrelated to exploitation
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-03
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs