CVE-2025-0498 is a critical (9.8) flaw in Rockwell Automation FactoryTalk AssetCentre: user tokens are stored insecurely and could be stolen to impersonate another user. Upgrade to V15.00.01 or later, which is the corrected version, or apply the Rockwell Automation January 2025 patch rollup on older versions.
What's affected
The record says all versions before V15.00.001 are affected. In Rockwell's advisory, V11, V12 and V13 are listed as affected with a patch available, and V15.00.01 and later is the corrected version.
The record describes insecure storage of FactoryTalk Security user tokens. A threat actor who can steal a token could impersonate another user. The advisory says this issue was found internally by Rockwell during routine testing.
Rockwell Automation advisory SD1721 was published on January 29, 2025. It covers three CVEs in FactoryTalk AssetCentre and states that none of them is a Known Exploited Vulnerability. It lists the issue as corrected, with a workaround available.
The weakness is CWE-522, insufficiently protected credentials. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which rates impact as high across confidentiality, integrity and availability.
How to check if you're exposed
Check the installed AssetCentre version on each server against the corrected version, V15.00.01. If you run V11, V12 or V13, look at the patch status for the Rockwell Automation January 2025 Monthly Patch rollup or a later one, since that is the patch the advisory names for this CVE.
Then review who can use the machine. The advisory lists restricting physical access to authorised users as a mitigation, so check local logins, remote desktop access and any shared accounts on the server.
If your environment records FactoryTalk Security sign-ins, look for activity from users at times or from hosts that do not match how they work. That log review will not prove token theft, but it can show unusual impersonation.
What to do now
- Inventory AssetCentre servers and versions.
- Upgrade to V15.00.01 or later, or install the January 2025 Monthly Patch rollup or a later rollup on legacy versions.
- Restrict physical and remote access to authorised users only.
- Review recent FactoryTalk Security activity for unusual users or hosts.
- Apply the fixes for the two sibling CVEs, CVE-2025-0477 and CVE-2025-0497, in the same window.
- Read the advisory again before you finish to confirm nothing changed since it was published.
Why it matters
A token is a stand-in for a login. If a stolen token is accepted, the attacker needs no password and may bypass multi factor checks. Good token handling means short lifetimes, storage in protected locations and binding tokens to the device or session that received them.
In a plant setting, the person being impersonated may have rights over device configurations and backups. A critical rating here is a prompt to patch in the next maintenance window and to tighten access to the server in the meantime.
Quick check
What is a user token and why steal it?
A token proves a user has already signed in. Someone who steals it can act as that user without knowing the password.
Which patch applies to CVE-2025-0498?
The advisory points to the Rockwell Automation January 2025 Monthly Patch rollup, or later, for legacy versions, and V15.00.01 or later as the full correction.
Sources
Last reviewed: 19 October 2026.
