Rockwell Automation vulnerabilities
We track 228 vulnerabilities in Rockwell Automation products across 60+ products. 228 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on October 13, 2026.
Latest Rockwell Automation vulnerabilities
- 8.7 High severity
FLEX 5000 I/O: Improper Validation of Specified Type of Input
A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection faul
- 8.7 High severity
FLEX 5000 I/O: Improper Validation of Specified Type of Input
A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection faul
- 9.1 Critical severity
FactoryTalk® Linx: Incorrect User Management
A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP token validation. This bypass allows access to create, update, and delete FTLinx drivers.
- 7.3 High severity
A security issues exists within Studio 5000 Logix Designer due to unsafe handling of…
A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Designer crashes; However, it may be possible to execute malicious code without triggering a crash.
- 8.5 High severity
FactoryTalk® Action Manager: Exposure of Sensitive Information to an Unauthorized Actor
A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and can be intercepted by any local client listening on the connection.
- 8.5 High severity
FactoryTalk® ViewPoint: Privilege Chaining
A security issue exists in FactoryTalk ViewPoint version 14.0 or below due to improper handling of MSI repair operations. During a repair, attackers can hijack the cscript.exe console window, which runs with SYSTEM privileges. This can be exploited to spawn an
- 8.8 High severity
5032-CFGB16M12P5DR: Missing Authentication for Critical Functionality
A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a 3-minute timeout window, allowing unauthorized users to perform privileged actions.
- 8.8 High severity
5032-CFGB16M12P5DR: Incorrect Authorization
A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an interval that correlates to the last two consecutive sign in session interval, making it predictable.
- 9.3 Critical severity
1756-EN2T/D: Initialization of a Resource with an Insecure Default
A security issue exists due to the web-based debugger agent enabled on Rockwell Automation ControlLogix® Ethernet Modules. If a specific IP address is used to connect to the WDB agent, it can allow remote attackers to perform memory dumps, modify memory, and c
- 7.8 High severity
Arena® Simulation: Heap-based Buffer Overflow
A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat act
- 7.8 High severity
Arena® Simulation: Stack-based Buffer Overflow
A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat act
- 7.8 High severity
Arena® Simulation: Heap-based Buffer Overflow
A memory abuse issue exists in the Rockwell Automation Arena® Simulation. A custom file can force Arena Simulation to read and write past the end of memory space. Successful use requires user action, such as opening a bad file or webpage. If used, a threat act
- 7.8 High severity
Arena®: Out-of-bounds Write
A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file withi
- 7.8 High severity
Arena®: Out-of-bounds Write
A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries of an allocated object. Exploitation requires user interaction, such as opening a malicious file withi
- 7.8 High severity
ThinManager®: Incorrect Default Permissions
A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder causing the Access Control Entry of the directory to inherit permissions from the parent directory. If ex
- 7.8 High severity
Arena®: Out-of-bounds Write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitra
- 7.8 High severity
Arena®: Out-of-bounds Read
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can di
- 7.8 High severity
Arena®: Out-of-bounds Read
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitra
- 7.8 High severity
Arena®: Out-of-bounds Read
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can di
- 7.8 High severity
Arena®: Out-of-bounds Read
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can di
- 7.8 High severity
Arena®: Out-of-bounds Write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can d
- 7.8 High severity
Arena®: Out-of-bounds Write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can d
- 7.8 High severity
Arena®: Out-of-bounds Write
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can d
- 7.8 High severity
Arena®: Access of Uninitialized Pointer
A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on t
- 7.8 High severity
Arena®: Access of Uninitialized Pointer
A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on t
- 7.8 High severity
Arena®: Access of Uninitialized Pointer
A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on t
- 9.8 Critical severity
FactoryTalk® AssetCentre: Insufficiently Protected Credentials
A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to insecure storage of FactoryTalk® Security user tokens, which could allow a threat actor to steal a token a
- 9.8 Critical severity
FactoryTalk® AssetCentre: Insufficiently Protected Credentials
A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to storing credentials in the configuration file of EventLogAttachmentExtractor, ArchiveExtractor, LogCleanUp
- 9.8 Critical severity
FactoryTalk® AssetCentre: Insufficiently Protected Credentials
An encryption vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to a weak encryption methodology and could allow a threat actor to extract passwords belonging to other users o
- 7.0 High severity
FactoryTalk® View Site Edition: Improper Control of Generation of Code
A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for DLLs to be executed with higher level permissions.
- 7.0 High severity
FactoryTalk® View Site Edition: Incorrect Permission Assignment for Critical Resource
An Incorrect Permission Assignment Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect permissions being assigned to the remote debugger port and can allow for unauthenticated access to the system configuration.
- 9.3 Critical severity
FactoryTalk® View Machine Edition: Improper Neutralization of Special Elements used in an OS Command
A Remote Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to lack of input sanitation and could allow a remote attacker to run commands or code as a high privileged user.
- 8.6 High severity
FactoryTalk View Machine Edition: Incorrect Authorization
A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access to the Command Prompt as a higher privileged user.
- 7.1 High severity
GuardLogix 5580 SIL 3: Improper Handling of Exceptional Conditions
A denial-of-service vulnerability exists in the affected products. The vulnerability could allow a remote, non-privileged user to send malicious requests resulting in a major nonrecoverable fault causing a denial-of-service.
- 8.7 High severity
PowerFlex 755: Cleartext Transmission of Sensitive Information
A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in credentials being sent in clear text.
- 7.0 High severity
DataEdgePlatform DataMosaix™ Private Cloud: Exposure of Sensitive Information to an Unauthorized Actor
A path traversal vulnerability exists in the Rockwell Automation DataEdge Platform DataMosaix Private Cloud. By specifying the character sequence in the body of the vulnerable endpoint, it is possible to overwrite files outside of the intended directory. A thr
- 7.3 High severity
Arena®: Out-of-bounds Write
A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To
- 7.8 High severity
Arena®: Use After Free
Another “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to use a resource that was already used. If exploited, a threat actor could leverage this
- 7.3 High severity
Arena®: Use of Uninitialized Resource
Another “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to access a variable prior to it being initialized. If exploited, a threat actor c
- 7.3 High severity
Arena®: Out-of-bounds Write
A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To