CVE-2025-9064 is a path traversal flaw in FactoryTalk View Machine Edition that lets an unauthenticated attacker on the same network delete files on the panel. The record scores it 9.1 Critical, while Rockwell rates it 7.5 on CVSS 3.1. Fix by moving to V15.00 or applying the patch.
What's affected
Per Rockwell Automation advisory SD1753, the affected product is FactoryTalk View ME earlier than V15.00. The advisory lists these fixes: FactoryTalk View ME V15.00 and later on ASEM 6300 industrial PCs, patch BF31001, and PanelView Plus 7 Performance Series B firmware V14.103.
The record says exploitation depends on knowing the names of the files to delete, and that the attacker is on the same network as the device. It gives CVSS 3.1 9.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H and lists CWE-22 (path traversal) and CWE-287.
Scoring differs between sources. Rockwell lists CVSS 3.1 7.5, CVSS 4.0 8.7 and CWE-22 only, with overall severity High. The record's 9.1 and the added authentication weakness are not in the advisory text we read, so cite the source with the score.
How to check if you're exposed
- Identify FactoryTalk View ME installs and their versions. Anything earlier than V15.00 is in scope.
- For PanelView Plus 7 Performance Series B terminals, read the firmware version and compare to V14.103.
- Check whether patch BF31001 is installed on systems that cannot move to V15.00.
- Map which hosts share a network segment with each panel. The record limits the attacker to the same network, so segment membership is your real exposure.
What to do now
- Upgrade FactoryTalk View ME to V15.00 or later on ASEM 6300 IPCs, or apply patch BF31001 where an upgrade is not possible.
- Update PanelView Plus 7 Performance Series B to firmware V14.103.
- Tighten network segmentation so only the systems that must talk to the panels can reach them.
- Take a backup of panel applications and configuration, so a deleted file is a restore job rather than an outage.
- Follow Rockwell's guidance on security best practices for anything you cannot update this quarter.
Why it matters
The core weakness is CWE-22, where a path supplied by a caller is not confined to an intended folder, so the caller can reach files elsewhere on the system. Here the impact the record describes is deletion of files on the panel operating system. That is an availability and integrity problem: a panel that loses files can stop showing or controlling a process until someone restores it.
The record does not flag this as a CISA Known Exploited Vulnerability, and the advisory does not report exploitation.
Quick check
Which version fixes CVE-2025-9064?
FactoryTalk View ME V15.00 or later on ASEM 6300 IPCs, patch BF31001, or PanelView Plus 7 Performance Series B firmware V14.103, per the advisory.
Does the attacker need to log in?
The record says unauthenticated, but on the same network as the device, and exploitation depends on knowing the file names.
Sources
Last reviewed: 18 October 2026.
