CVE-2025-7329
BaseFortify
Publication date: 2025-10-14
Last updated on: 2025-10-30
Assigner: Rockwell Automation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rockwellautomation | 1783-natr_firmware | to 1.007 (exc) |
| rockwellautomation | 1783-natr | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the affected product. It occurs because the product does not properly filter and encode special characters in configuration fields. An attacker who can log in as an admin and update these configuration fields can inject malicious scripts that are stored and later executed when viewed, potentially allowing the attacker to view or modify sensitive data or disrupt the webpage's availability.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow a malicious user to view and modify sensitive data within the application or cause the webpage to become unavailable. This could lead to unauthorized data access, data manipulation, and denial of service conditions, impacting the security and availability of the system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that only trusted administrators have access to update configuration fields, as exploitation requires admin login. Additionally, apply proper input validation and encoding to configuration fields to prevent stored cross-site scripting. Monitor and restrict administrative access and consider applying any available patches or updates from the vendor once released.