CVE-2025-9067
BaseFortify
Publication date: 2025-10-14
Last updated on: 2025-10-20
Assigner: Rockwell Automation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rockwellautomation | factorytalk_linx | to 6.50 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo | |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the x86 Microsoft Installer File (MSI) installed with FTLinx. Authenticated attackers with valid Windows user credentials can initiate a repair process and hijack the resulting console window. This hijacking allows them to launch a command prompt running with SYSTEM-level privileges, giving them full access to all files, processes, and system resources on the affected system.
How can this vulnerability impact me? :
The vulnerability can allow an attacker with valid Windows credentials to escalate their privileges to SYSTEM level. This means the attacker can gain full control over the system, access all files and processes, and potentially execute any code or commands with the highest level of system privileges, leading to severe security risks including data theft, system compromise, and disruption of services.