CVE-2025-7328 is a critical missing authentication flaw (CVSS 9.8 in the record) in the Rockwell Automation 1783-NATR network address translation router. Firmware 1.006 and earlier is affected. Rockwell lists 1.007 and later as the corrected version. Rockwell says it is not in the CISA KEV catalog and lists no workaround beyond its security best practices.
What's affected
Rockwell's advisory (SD1756, first released 14 October 2025) lists the 1783-NATR, a configurable NAT router that maps addresses between machine and control networks. Affected software is 1.006 and prior. Corrected software is 1.007 and later. The record lists the product and its firmware.
The advisory describes multiple broken authentication issues caused by missing authentication checks on critical functions. Rockwell lists three outcomes: denial of service, admin account takeover and NAT rule modification. A changed NAT rule could send device traffic to the wrong endpoint. An admin takeover could change the configuration, and the advisory says restoring the device would then require physical access.
Severity differs between sources. The record shows CVSS 3.1 9.8 (critical, vector AV:N/AC:L/PR:N/UI:N with high impact on all three areas). Rockwell's advisory shows CVSS 3.1 10.0 and CVSS 4.0 9.9. Both are critical, but the numbers do not match, so quote the source you rely on.
The advisory also covers two sibling CVEs on the same product and versions: CVE-2025-7329, a stored cross-site scripting issue, and CVE-2025-7330, a cross-site request forgery issue. Updating covers all three. Rockwell says none of them is in the CISA KEV catalog, and the record's flag is false.
The weakness is CWE-306, missing authentication for a critical function.
How to check if you're exposed
Find every 1783-NATR on your plant and control networks. Asset lists and the module's own web interface are the usual sources. Then read the firmware version. Rockwell's advisory lists the affected and corrected versions, and you should use Rockwell's own documentation to read the version on the device.
Next, check how the device is reachable. A NAT router sits between machine and control networks, so ask which networks can reach its management interface. The record's vector says the flaw can be reached over the network with no privileges, so a management interface open to a wide network is the worst case.
Look at the current NAT rules against your documented design. Rules that nobody can explain deserve attention. Do not treat a clean comparison as proof, since the advisory does not describe a way to detect misuse.
What to do now
- Inventory all 1783-NATR devices and read their firmware versions.
- Plan the upgrade to 1.007 or later through Rockwell's download process and your normal change control for control networks.
- Until you can update, follow Rockwell's security best practices, which the advisory names as the workaround. Limit who can reach the management interface.
- Back up the current configuration and rule set before the upgrade, and save a known good copy for later comparison.
- After the update, confirm NAT rules and admin accounts match your documented design.
- Read the full advisory for the two related CVEs and track all three.
Why it matters
Missing authentication is simple to describe. A function that should check who is calling does not. On a NAT router in an industrial network, the functions at stake are the ones that decide where traffic goes and who administers the device.
Industrial environments patch slowly, because downtime has a real cost and changes need testing. That makes network placement a main control while you wait. The advisory's point about physical access to restore a taken over device is the sort of detail that should push this up your list.
Quick check
Is CVE-2025-7328 exploited in the wild?
Rockwell's advisory says it is not listed in the CISA KEV database, and the record's KEV flag is false.
Which version fixes it?
Rockwell lists 1.007 and later as corrected. Affected is 1.006 and prior.
Sources
Last reviewed: 18 October 2026.
