Vulnerability · Published Oct 14, 2025 · Assigned by Rockwell

CVE-2025-9068Rockwell Automation FactoryTalk® Linx Privilege Escalation Vulnerabilities

High 8.5

In plain English

A high-severity privilege mismanagement in FactoryTalk Linx from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.2%top 91.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security issue exists within the Rockwell Automation Driver Package x64 Microsoft Installer File (MSI) repair functionality, installed with FTLinx. Authenticated attackers with valid Windows Users credentials can initiate a repair and hijack the resulting console window for vbpinstall.exe. This allows the launching of a command prompt running with SYSTEM-level privileges, allowing full access to all files, processes, and system resources.

Affected products (as reported)

Vendor	Product	Versions
Rockwell Automation	FactoryTalk Linx	6.40 and prior

Weakness: CWE-269 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1754.html