CVE-2025-7774

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-7774", "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0", "state": "PUBLISHED", "assignerShortName": "Rockwell", "dateReserved": "2025-07-17T18:26:26.467Z", "datePublished": "2025-08-14T13:39:59.455Z", "dateUpdated": "2025-08-14T14:01:08.395Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "5032-CFGB16M12P5DR", "vendor": "Rockwell Automation", "versions": [{"status": "affected", "version": "1.011"}]}, {"defaultStatus": "unaffected", "product": "5032-CFGB16M12DR", "vendor": "Rockwell Automation", "versions": [{"status": "affected", "version": "1.011"}]}, {"defaultStatus": "unaffected", "product": "5032-CFGB16M12M12LDR", "vendor": "Rockwell Automation", "versions": [{"status": "affected", "version": "1.011"}]}], "datePublic": "2025-08-14T13:11:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p>\n\n<p></p>\n\n<p></p>\n\n<p>A security issue exists within the 5032 16pt Digital Configurable module\u2019s web server. Intercepted session credentials can be used within a 3-minute timeout window, allowing unauthorized users to perform privileged actions. </p><br>\n\n<br>\n\n<br>\n\n<br>"}], "value": "A security issue exists within the 5032 16pt Digital Configurable module\u2019s web server. Intercepted session credentials can be used within a 3-minute timeout window, allowing unauthorized users to perform privileged actions."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "b73dd486-f505-4403-b634-40b078b177f0", "shortName": "Rockwell", "dateUpdated": "2025-08-14T13:51:39.909Z"}, "references": [{"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1733.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "1.012 or later"}], "value": "1.012 or later"}], "source": {"advisory": "SD1733", "discovery": "INTERNAL"}, "title": "Rockwell Automation ArmorBlock 5000 I/O \u2013 Web Server Vulnerabilities", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-14T14:01:02.357861Z", "id": "CVE-2025-7774", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T14:01:08.395Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7774", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-14T14:01:02.357861Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T14:01:05.297Z"}}], "cna": {"title": "Rockwell Automation ArmorBlock 5000 I/O \u2013 Web Server Vulnerabilities", "source": {"advisory": "SD1733", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Rockwell Automation", "product": "5032-CFGB16M12P5DR", "versions": [{"status": "affected", "version": "1.011"}], "defaultStatus": "unaffected"}, {"vendor": "Rockwell Automation", "product": "5032-CFGB16M12DR", "versions": [{"status": "affected", "version": "1.011"}], "defaultStatus": "unaffected"}, {"vendor": "Rockwell Automation", "product": "5032-CFGB16M12M12LDR", "versions": [{"status": "affected", "version": "1.011"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "1.012 or later", "supportingMedia": [{"type": "text/html", "value": "1.012 or later", "base64": false}]}], "datePublic": "2025-08-14T13:11:00.000Z", "references": [{"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1733.html"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A security issue exists within the 5032 16pt Digital Configurable module\u2019s web server. Intercepted session credentials can be used within a 3-minute timeout window, allowing unauthorized users to perform privileged actions.", "supportingMedia": [{"type": "text/html", "value": "<p></p>\n\n<p></p>\n\n<p></p>\n\n<p>A security issue exists within the 5032 16pt Digital Configurable module\u2019s web server. Intercepted session credentials can be used within a 3-minute timeout window, allowing unauthorized users to perform privileged actions. </p><br>\n\n<br>\n\n<br>\n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "b73dd486-f505-4403-b634-40b078b177f0", "shortName": "Rockwell", "dateUpdated": "2025-08-14T13:51:39.909Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7774", "state": "PUBLISHED", "dateUpdated": "2025-08-14T14:01:08.395Z", "dateReserved": "2025-07-17T18:26:26.467Z", "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0", "datePublished": "2025-08-14T13:39:59.455Z", "assignerShortName": "Rockwell"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "5032-CFGB16M12P5DR", "vendor": "Rockwell Automation", "versions": [{"status": "affected", "version": "1.011"}]}, {"defaultStatus": "unaffected", "product": "5032-CFGB16M12DR", "vendor": "Rockwell Automation", "versions": [{"status": "affected", "version": "1.011"}]}, {"defaultStatus": "unaffected", "product": "5032-CFGB16M12M12LDR", "vendor": "Rockwell Automation", "versions": [{"status": "affected", "version": "1.011"}]}], "source": "PSIRT@rockwellautomation.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security issue exists within the 5032 16pt Digital Configurable module\u2019s web server. Intercepted session credentials can be used within a 3-minute timeout window, allowing unauthorized users to perform privileged actions."}, {"lang": "es", "value": "Existe un problema de seguridad en el servidor web del m\u00f3dulo digital configurable 5032 de 16 puntos. Las credenciales de sesi\u00f3n interceptadas pueden usarse dentro de un per\u00edodo de tiempo de espera de 3 minutos, lo que permite a usuarios no autorizados realizar acciones privilegiadas."}], "id": "CVE-2025-7774", "lastModified": "2026-06-17T10:05:37.957", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "PSIRT@rockwellautomation.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7774", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-14T14:01:02.357861Z", "version": "2.0.3"}}]}, "published": "2025-08-14T14:15:35.493", "references": [{"source": "PSIRT@rockwellautomation.com", "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1733.html"}], "sourceIdentifier": "PSIRT@rockwellautomation.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "PSIRT@rockwellautomation.com", "type": "Secondary"}]}

{}

{"created": "2025-08-16T21:41:14.283413+00:00", "updated": "2025-08-16T21:41:14.283495+00:00", "vendors": ["rockwellautomation", "rockwellautomation$PRODUCT$armorblock_5000_io"]}