Rockwell Automation FactoryTalk and PanelView path traversal flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unauthenticated path traversal and authentication bypass in Rockwell Automation industrial control software allow file system access.
Rockwell Automation FactoryTalk View Machine Edition and PanelView Plus 7 contain two critical vulnerabilities affecting industrial control systems deployed worldwide. CVE-2025-9064 is a path traversal vulnerability in FactoryTalk View Machine Edition versions prior to V15.00 that allows unauthenticated network attackers to delete arbitrary files on the device's operating system, requiring only knowledge of target filenames. CVE-2025-9063 is an authentication bypass in the FactoryTalk View Machine Edition Web Browser ActiveX control affecting PanelView Plus 7 Series B that permits unauthorized access to the file system, diagnostic information, and event logs.
Both vulnerabilities are remotely exploitable or locally exploitable with low attack complexity and require no user interaction. CVSS v4 scores reach 8.7 for CVE-2025-9064 (availability impact) and 7.0 for CVE-2025-9063 (confidentiality and availability impact). Rockwell Automation has released patches: FactoryTalk View ME V15.00 with Patch BF31001 for CVE-2025-9064, and PanelView Plus 7 Performance Series B V14.103 firmware for both vulnerabilities. CISA reports no known public exploitation as of the advisory date, but defenders should prioritize patching given the direct access to critical manufacturing equipment file systems.
Mentioned in this report
Detection guidance
Path Traversal Sequences in Web Request URI
Web requests whose URI or query contains directory traversal sequences, the pattern used to reach arbitrary file paths such as the FactoryTalk View ME path traversal (CVE-2025-9064). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Path Traversal Sequences in Web Request URI
description: Detects web requests whose URI stem or query contains plain or URL-encoded
directory traversal sequences. This is the generic exploitation pattern for path
traversal flaws such as CVE-2025-9064 (FactoryTalk View ME) when the affected service
is exposed through an HTTP front end or logged by a web server or reverse proxy.
The advisory does not describe the exact request format, so this rule covers the
traversal technique and not a product-specific URL.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_stem:
cs-uri-stem|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e%5c'
- ..%2f
- ..%5c
- '%252e%252e%252f'
selection_query:
cs-uri-query|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e%5c'
- ..%2f
- ..%5c
- '%252e%252e%252f'
filter_success_block:
sc-status:
- 400
- 403
condition: 1 of selection_* and not filter_success_block
falsepositives:
- Vulnerability scanners run by the internal security team against web-exposed assets
- Web applications that legitimately pass relative paths in query parameters, such
as file-manager or documentation viewers
level: medium
id: f8d0affb-0402-5e26-abc2-49052cf004ba
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-01
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,577 reports from 145 sources, 598 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs