Vulnerability · Published Sep 9, 2025 · Assigned by Rockwell
CVE-2025-9161Rockwell Automation FactoryTalk Optix Remote Code Execution Vulnerability
High 7.3
In plain English
A high-severity command injection in FactoryTalk Optix from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).
Severity (CVSS 4.0)7.3High
Exploit odds (30 days)0.6%top 53.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A security issue exists within FactoryTalk Optix MQTT broker due to the lack of URI sanitization. This flaw enables the loading of remote Mosquito plugins, which can be used to achieve remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | FactoryTalk Optix | All Versions 1.5.0 - 1.5.7 |
Weakness: CWE-77 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N