CVE-2025-0477 is a critical (9.8) weak encryption flaw in Rockwell Automation FactoryTalk AssetCentre. All versions before V15.00.001 are affected. Update to V15.00.01 or later, which Rockwell lists as the corrected version, and limit database access to the people who need it.
What's affected
The record says the flaw exists in all versions of FactoryTalk AssetCentre prior to V15.00.001. The vendor's advisory table gives the corrected version as V15.00.01 and later. The record says the problem is a weak encryption method that could allow a threat actor to extract the passwords of other users of the application.
Rockwell Automation advisory SD1721 was published on January 29, 2025. It covers three CVEs in FactoryTalk AssetCentre and states that none of them is a Known Exploited Vulnerability. It lists the issue as corrected, with a workaround available.
The weakness is CWE-522, insufficiently protected credentials. The advisory adds a detail that matters for defenders: the encrypted data is stored in a table in the database. That is why one of the vendor's mitigations is to control access to the database for users who do not need it.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means a network attack, low complexity, no privileges and no user interaction, with high impact on each of confidentiality, integrity and availability. The vendor's own statement is that the issue is not on the CISA Known Exploited Vulnerabilities list.
Two sibling CVEs came out in the same advisory. CVE-2025-0497 covers credentials stored in configuration files for some log and archive packages, and CVE-2025-0498 covers insecure storage of user tokens. Each has its own post.
How to check if you're exposed
Find the installed version of FactoryTalk AssetCentre on each server. The product's own version information, or the installed programs list on the Windows server, will show it. Anything older than V15.00.01 is in scope, as the record puts the cutoff at prior to V15.00.001.
Then look at who can reach the AssetCentre database. List the accounts and groups with read access to the database that stores the application's data, and ask whether each one needs it. Anyone who can read that table could try to recover stored passwords under the weakness the record describes.
Also check network exposure. Industrial asset management servers should not be reachable from the internet, and should sit behind your plant or corporate segmentation. Follow the vendor's published guidance on securing industrial automation systems.
What to do now
- Inventory every FactoryTalk AssetCentre server and its version.
- Plan an upgrade to V15.00.01 or later, following Rockwell's guidance and your change process for operational technology.
- Until you upgrade, limit database access to essential accounts only, as the advisory says.
- Treat stored AssetCentre user passwords as potentially exposed if non-essential people had database access, and rotate them.
- Check that the server is not reachable from the internet and is segmented from untrusted networks.
- Read the full advisory for the other two CVEs and apply their patches in the same maintenance window.
Why it matters
Reversible or weak encryption protects a password only as long as the key or method stays hidden. If the way passwords are stored can be undone by anyone who reads the table, the stored value is as good as the password. The safe pattern is to avoid storing reversible passwords at all and to use a slow one-way hash where the application only needs to verify a password.
AssetCentre manages and backs up configuration for industrial devices. A stolen account there can open a path to the systems it looks after, so the combination of a critical score and a plant setting deserves a planned fix, not a deferred one.
Quick check
Which version fixes CVE-2025-0477?
Rockwell lists V15.00.01 and later as the corrected version. The record says versions prior to V15.00.001 are affected.
Is there a workaround before I can upgrade?
Yes. The advisory says to control access to the database by non-essential users, since the encrypted data sits in a database table.
Sources
Last reviewed: 19 October 2026.
