Rockwell FactoryTalk Historian flaws enable auth bypass, DoS
Three vulnerabilities in Rockwell Automation FactoryTalk Historian Site Edition allow authentication bypass via race condition and authenticated denial-of-service attacks against critical manufacturing systems.
CISA disclosed three vulnerabilities affecting Rockwell Automation FactoryTalk Historian Site Edition version 11 and earlier, deployed in critical manufacturing environments worldwide. CVE-2025-13036 is an authentication bypass stemming from a race condition that allows attackers to obtain valid authentication tokens by repeatedly sending requests to the login endpoint. CVE-2025-44019 and CVE-2025-36539 are uncaught exception vulnerabilities that permit authenticated users to crash PI Data Archive subsystems, resulting in denial of service and potential data loss from snapshots or write cache.
Rockwell Automation has released patch BF32850 for CVE-2025-13036 and recommends monitoring and automatic restart configuration for the DoS vulnerabilities. Workarounds include restricting port 5450 access to trusted systems and implementing PI System security best practices. No public exploitation has been reported to CISA at this time. The vulnerabilities impact industrial control systems in critical manufacturing sectors, requiring prompt remediation by affected organizations.
Mentioned in this report
Detection guidance
Repeated Authentication Requests to PI Data Archive Login Endpoint (Possible Race-Condition Auth Bypass)
Detects bursts of connection attempts to the FactoryTalk Historian / PI Data Archive service port (5450) consistent with the CVE-2025-13036 race-condition token theft technique. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Connections to PI Data Archive Service Port
id: d4d703ae-df70-56f4-8856-ba408703d4af
status: experimental
description: 'Detects multiple rapid connection attempts to TCP/5450, the FactoryTalk
Historian/PI Data Archive service port. CVE-2025-13036 allows an attacker to bypass
authentication by repeatedly sending login requests to trigger a race condition
and obtain a valid token. A high volume of short-lived connections from a single
source to this port in a short window is indicative of this exploitation attempt;
correlate with connection-rate thresholds in your SIEM (e.g. >20 connections from
one source within 60 seconds) as this cannot be expressed natively in Sigma.
'
references:
- https://www.cisa.gov/news-events/ics-advisories
author: Vorant
tags:
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 5450
Initiated: 'true'
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Legitimate PI System client applications polling the Historian service frequently
- Load balancers or health-check monitors probing the service port
level: medium
Anomalous Connection Volume to PI Data Archive Service Port (Potential DoS)
Detects an unusual spike of connections/traffic to the PI Data Archive service port 5450 that may indicate an attempt to exploit uncaught exception DoS vulnerabilities (CVE-2025-44019, CVE-2025-36539). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: High Volume Traffic to PI Data Archive Port 5450
id: d2d11546-35b6-52f1-bc23-6b82260851ee
status: experimental
description: 'Detects network traffic targeting TCP/5450 (PI Data Archive / FactoryTalk
Historian). Uncaught exception vulnerabilities (CVE-2025-44019, CVE-2025-36539)
can be triggered by sending crafted authenticated requests that crash the subsystem,
causing denial of service. A sustained increase in connections or repeated reconnections
to this port from authenticated or unauthenticated sources may indicate exploitation
attempts; apply a rate/count threshold (e.g. connection bursts exceeding baseline
by 3x within 5 minutes) in the SIEM correlation layer since Sigma cannot express
aggregation thresholds.
'
references:
- https://www.cisa.gov/news-events/ics-advisories
author: Vorant
tags:
- attack.t1498
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 5450
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Normal historian client polling from multiple engineering workstations
- Scheduled batch data collection jobs connecting to the archive service
level: medium
PI Data Archive Subsystem Crash Event Following Client Request
Detects Windows Application Error / crash events for PI Data Archive related processes, which may indicate successful exploitation of an uncaught exception DoS vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PI Data Archive Process Crash Logged in Windows Application Event Log
id: 5c7bd7f5-25f6-5bc3-afa6-0ced41c3030c
status: experimental
description: 'Detects application crash/error events for PI Data Archive or related
FactoryTalk Historian subsystem processes recorded in the Windows Application event
log. CVE-2025-44019 and CVE-2025-36539 allow authenticated attackers to send crafted
requests that trigger uncaught exceptions, crashing the service and causing data
loss and denial of service.
'
references:
- https://www.cisa.gov/news-events/ics-advisories
author: Vorant
tags:
- attack.t1498
logsource:
product: windows
service: application
detection:
selection:
Provider_Name: Application Error
EventID: 1000
keyword_filter:
Data|contains:
- pisubsys
- pinetmgr
- piarchss
- FactoryTalk Historian
condition: selection and keyword_filter
falsepositives:
- Unrelated third-party application crashes sharing generic Application Error event
ID
- Crashes caused by legitimate software bugs or resource exhaustion unrelated to exploitation
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-03
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free