CVE-2025-14377
Plaintext Secret Exposure in Verve Asset Manager Ansible Playbook
Publication date: 2026-01-20
Last updated on: 2026-01-20
Assigner: Rockwell Automation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rockwellautomation | verve_asset_manager | From 1.36 (exc) to 1.42 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability (CVE-2025-14377) affects the legacy Ansible playbook component of Verve Asset Manager. It involves plaintext secrets being incorrectly stored during the execution of a playbook, which means sensitive information is stored in cleartext and could be exposed. This component has been retired and made optional since version 1.36 (2024) and fully removed in version 1.42. [1]
How can this vulnerability impact me? :
The vulnerability can lead to exposure of sensitive secrets stored in plaintext during playbook execution, potentially allowing unauthorized access or misuse of sensitive information. This could compromise the security of industrial control systems managed by Verve Asset Manager. However, since the affected component is legacy, optional since 1.36, and fully removed in 1.42, the risk is mitigated by upgrading to the latest version. [1]
What immediate steps should I take to mitigate this vulnerability?
The affected legacy Ansible playbook component has been retired and optional since version 1.36 and fully removed in version 1.42 of Verve Asset Manager. The vulnerability is corrected by upgrading to version 1.42 or later, which fully removes the vulnerable component. No specific workarounds are provided. If upgrading is not possible, it is advised to follow Rockwell Automation's security best practices and contact their TechConnect support for further assistance. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.