BaseFortify

Publication date: 2025-10-14

Last updated on: 2025-10-30

Assigner: Rockwell Automation

Description

A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify sensitive data or make the webpage unavailable. The vulnerability stems from missing special character filtering and encoding. Successful exploitation requires an attacker to be able to update configuration fields behind admin login.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-14

Last Modified

2025-10-30

Generated

2026-07-06

AI Q&A

2025-10-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-7329

Affected Vendors & Products

Vendor	Product	Version / Range
rockwellautomation	1783-natr_firmware	to 1.007 (exc)
rockwellautomation	1783-natr	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the affected product. It occurs because the product does not properly filter and encode special characters in configuration fields. An attacker who can log in as an admin and update these configuration fields can inject malicious scripts that are stored and later executed when viewed, potentially allowing the attacker to view or modify sensitive data or disrupt the webpage's availability.

Impact Analysis

If exploited, this vulnerability could allow a malicious user to view and modify sensitive data within the application or cause the webpage to become unavailable. This could lead to unauthorized data access, data manipulation, and denial of service conditions, impacting the security and availability of the system.

Mitigation Strategies

To mitigate this vulnerability, ensure that only trusted administrators have access to update configuration fields, as exploitation requires admin login. Additionally, apply proper input validation and encoding to configuration fields to prevent stored cross-site scripting. Monitor and restrict administrative access and consider applying any available patches or updates from the vendor once released.

Hi! I’m here to help you understand CVE-2025-7329. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70