Critical severity · published Oct 14, 2025
CVE-2025-9064
Rockwell Automation FactoryTalk View Machine Edition Path Traversal
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the panels operating system. Exploitation of this vulnerability is dependent on the knowledge of filenames to be deleted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FV
FactoryTalk View Machine Edition · Rockwell Automation
V15.00 and prior · source: vendor
FV
Factorytalk View · Rockwellautomation
through 15.0 · source: NVD
Affected product
FV
FactoryTalk View Machine Edition
Rockwell Automation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9064
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9064
Vendor Advisory
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1753.html
More from FactoryTalk View Machine Edition
9.3
CVE-2025-24480
FactoryTalk® View Machine Editon - Remote Code Execution
8.6
CVE-2025-24479
FactoryTalk® View Machine Edition - Local Code Injection
7.8
CVE-2024-37365
FactoryTalk View ME Remote Code Execution Vulnerability via Project Save Path