CVE-2025-7972 is a critical (record CVSS 9.1) authentication token bypass in FactoryTalk Linx. Rockwell Automation says it is fixed in version 6.50, and scores it 9.0 under CVSS 3.1 with a local attack vector. Update to 6.50 or later, or follow the vendor's security best practices if you cannot upgrade yet.
What's affected
The record lists FactoryTalk Linx versions before 6.50 as affected.
Rockwell's advisory says to update to FactoryTalk Linx 6.50 or later.
The advisory describes a security issue in the Network Browser component. Changing the process.env.NODE_ENV value to development disables FTSP token validation, which opens up creating, updating and deleting FTLinx drivers.
The record's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, a score of 9.1. Rockwell says the issue was found in internal routine testing. The advisory says it is not in CISA's Known Exploited Vulnerabilities catalog.
The record's kev flag is false, so the CVE is not in CISA's Known Exploited Vulnerabilities catalog at the time of this review.
How to check if you're exposed
On the host, open FactoryTalk Linx and read the version from its About information, or from the installed programs list on Windows. Anything before 6.50 is affected. Also check which machines can reach the Linx Network Browser service, since the record's vector assumes a network attacker while Rockwell's own vector assumes local access.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether this CVE appears in a project's dependency list. Note that it covers packages. Stand-alone applications and firmware are best checked against your own inventory.
What to do now
- Inventory the hosts that run FactoryTalk Linx and read their versions.
- Update to 6.50 or later.
- If you cannot update yet, apply the security best practices that Rockwell's advisory points to, and limit network access to the Linx Network Browser.
- Keep these hosts off the internet and out of flat office networks.
- Review the list of configured drivers for entries nobody on your team created.
If you maintain a codebase and want to know whether a vulnerable package is actually called, Safeguard's reachability analysis separates packages that are present from code paths that are used.
Why it matters
The weakness class here is CWE-286 (incorrect user management). The reported problem is that a runtime environment setting changes the security behavior of the application: switching to development disables token validation. Security checks should not depend on a flag that can be altered by someone who can reach the process.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-7972?
Rockwell's advisory says to update to FactoryTalk Linx 6.50 or later.
Is CVE-2025-7972 being exploited in the wild?
The record's kev flag is false, so it is not in CISA's Known Exploited Vulnerabilities catalog. No advisory I read says it is being exploited.
Sources
- Safeguard Gold entry for CVE-2025-7972
- Rockwell Automation advisory SD1735
- NVD record data for CVE-2025-7972, published 2025-08-14, source PSIRT@rockwellautomation.com
Last reviewed: 18 October 2026.
