CVE-2025-9063 is an authentication bypass in the FactoryTalk View Machine Edition Web Browser ActiveX control that exposes the PanelView Plus 7 Series B. The record scores it 9.8 Critical, while Rockwell Automation rates its advisory High. The fix is PanelView Plus 7 Performance Series B firmware V14.103.
What's affected
Per Rockwell Automation advisory SD1753, the affected product is the PanelView Plus 7 Performance Series B at V14.100. The corrected firmware is V14.103. The record describes unauthorized access to the terminal, including the file system, diagnostic information and event logs.
The sources disagree on scoring and weakness class, so here are both. The record lists CVSS 3.1 score 9.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-287 (improper authentication). Rockwell's advisory lists CVSS 3.1 score 7.3, CVSS 4.0 score 7.0, and CWE-285 (improper authorization). The advisory's overall severity is High. For planning, treat the higher figure as the safe assumption for a panel that cannot be patched quickly.
The advisory also names a workaround for customers who cannot update: remove the Web Browser ActiveX control. It points to Rockwell's security best practices for network hardening.
How to check if you're exposed
- On the PanelView Plus 7 Performance Series B terminal, find the firmware version in the device information screen and compare it to V14.100 and V14.103.
- Use your asset inventory or the FactoryTalk tooling you already run to list every PanelView Plus 7 Series B on each site.
- Find out whether any client uses the FactoryTalk View ME Web Browser ActiveX control against these terminals.
- Confirm which networks can reach the terminals. Anything beyond the control network is a finding.
What to do now
- Update PanelView Plus 7 Performance Series B terminals to firmware V14.103, following Rockwell's instructions and your plant change control.
- If you cannot update yet, remove the Web Browser ActiveX control, as the advisory suggests.
- Keep these terminals off the internet and off general corporate networks. Segment them behind a firewall that allows only the traffic production needs.
- Review event logs on exposed terminals for access you cannot explain.
- Read the full advisory, because it covers related CVE-2025-9064 in the same product family, covered in our separate post.
Why it matters
The weakness class in the record is CWE-287. The advisory classifies it as CWE-285. Either way the control is bypassed, so a party that can reach the panel gets access it should not have: files, diagnostics and logs. Industrial panels sit close to physical processes, and they are patched on maintenance schedules rather than monthly cycles, which stretches the exposure window.
The record does not flag a CISA Known Exploited Vulnerability, and the advisory we read does not report exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which firmware fixes CVE-2025-9063?
PanelView Plus 7 Performance Series B V14.103, per Rockwell Automation advisory SD1753.
Critical or High?
The record says 9.8 Critical. Rockwell rates it High with CVSS 3.1 of 7.3. Both are in this post so you can choose your own threshold.
Sources
Last reviewed: 18 October 2026.
