CVE-2025-9064

CriticalCVSS 9.1

Published: 14/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.61%

47th percentile - higher than 47% of all known CVEs

Summary

A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the panel's operating system. Exploitation depends on knowledge of the filenames to be deleted.

Risk Assessment

An attacker on the same network could delete arbitrary files on the panel's operating system, potentially destabilizing or destroying the device configuration. Exploitation is limited by the need to know the filenames.

Recommendation

Apply the vendor's available updates for FactoryTalk View Machine Edition and segment the network to limit access to HMI panels.

Other vulnerabilities in FactoryTalk View Machine Edition

CVE-2025-9063Critical
An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access to the PanelView Plus 7 Series B, including access to the file system, retrieval of diagnostic information, event logs, and more.

Original NVD description (English source)

A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the panels operating system. Exploitation of this vulnerability is dependent on the knowledge of filenames to be deleted.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS