Vulnerability · Published Sep 9, 2025 · Assigned by Rockwell
CVE-2025-7970Rockwell Automation FactoryTalk Activation Manager Lack of Encryption Vulnerability
High 8.7
In plain English
A high-severity missing authentication in FactoryTalk Activation Manager from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.4%top 69.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A security issue exists within FactoryTalk Activation Manager. An error in the implementation of cryptography within the software could allow attackers to decrypt traffic. This could result in data exposure, session hijacking, or full communication compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | FactoryTalk Activation Manager | 5.00 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N