CVE-2025-0497 is a critical (9.8) flaw in Rockwell Automation FactoryTalk AssetCentre: credentials are stored in the configuration files of four packages. Update to V15.00.01 or later, which is the corrected version, or apply the vendor patches that Rockwell provides for V11, V12 and V13.
What's affected
The record says all versions before V15.00.001 are affected. Rockwell's advisory table narrows this for the legacy lines: V11, V12 and V13 are affected, with a patch available, and V15.00.01 and later is the corrected version.
The flaw is a data exposure problem. The record says credentials are stored in the configuration file of the EventLogAttachmentExtractor, ArchiveExtractor, LogCleanUp, or ArchiveLogCleanUp packages. Anyone who can read those files may read the credentials inside them.
Rockwell Automation advisory SD1721 was published on January 29, 2025. It covers three CVEs in FactoryTalk AssetCentre and states that none of them is a Known Exploited Vulnerability. It lists the issue as corrected, with a workaround available.
The weakness is CWE-522, insufficiently protected credentials. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with high impact on confidentiality, integrity and availability. The advisory says it is not a Known Exploited Vulnerability.
How to check if you're exposed
Identify the AssetCentre version on each server. Then find the four packages named in the record on the host and see whether they are installed. The configuration files sit with those packages, so list their locations and check who can read them.
Review file permissions on the folders that hold those configuration files. Only the service account and administrators should have read access. If broad groups can read them, the stored credentials are exposed to every member.
Because the advisory lists restricting physical access to the machine as a mitigation, include the physical and remote console in your review: who can log in at the machine, and who can reach it through remote desktop or file shares.
What to do now
- Record the AssetCentre version and the installed packages on each server.
- Upgrade to V15.00.01 or later where you can.
- For legacy versions, apply the vendor patches. For LogCleanUp and ArchiveLogCleanUp, the advisory says to install the Rockwell Automation January 2025 Monthly Patch rollup, or later. For EventLogAttachmentExtractor and ArchiveExtractor, it points to article BF31148 for the patch files and instructions.
- Restrict physical and remote access to the server to authorised people.
- Tighten read permissions on the package configuration files.
- Rotate the credentials that were stored in those files, since you cannot know who read them.
Why it matters
Credentials in a plain configuration file turn every file read into an account takeover. Configuration files get copied into backups, tickets and shared folders, which spreads the secret far beyond the host. The better pattern is to keep secrets in a protected store, give each service the least privilege it needs, and rotate them on a schedule.
The score is high because the credentials may open further systems. The advisory's mitigations focus on patching and on limiting who can touch the machine, which matches the weakness: the risk is about who can read the files.
Quick check
Do I have to upgrade to V15.00.01 to be fixed?
No. For V11, V12 and V13 the advisory says patches are available. Upgrading to V15.00.01 or later is the full correction.
Should I rotate credentials after patching?
Yes, if the files were readable by anyone who should not have had access. A patch removes the exposure going forward but does not change secrets that may already have been read.
Sources
Last reviewed: 19 October 2026.
