CVE-2025-7972
Published: 14 August 2025
Summary
CVE-2025-7972 is a high-severity Incorrect User Management (CWE-286) vulnerability in Rockwellautomation Factorytalk Linx. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 27.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-7972, published on 2025-08-14, is a security vulnerability in the FactoryTalk Linx Network Browser. The issue allows an attacker to disable FTSP token validation by modifying the process.env.NODE_ENV variable to 'development'. This bypass enables unauthorized access to create, update, and delete FTLinx drivers. It carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) and maps to CWE-286 (Incorrect Authorization).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation bypasses authentication controls, allowing manipulation of FTLinx drivers and resulting in high impacts to integrity and availability, though no confidentiality impact.
The Rockwell Automation security advisory provides details on mitigation; refer to https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1735.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24826
Vulnerability details
A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP token validation. This bypass allows access to create, update, and delete FTLinx drivers.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated authentication bypass in a network-exposed component (FactoryTalk Linx Network Browser) directly enables T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by identifying, reporting, and correcting the flaw enabling FTSP token validation bypass via NODE_ENV modification.
Ensures secure configuration settings prevent deployment or runtime use of NODE_ENV='development' that disables token validation in production.
Enforces approved access authorizations to block unauthorized create, update, and delete operations on FTLinx drivers despite the token bypass.