CVE-2025-12768

Rockwell Automation's FactoryTalk Historian Machine Edition contains an out-of-bounds write (CWE-787) that can be triggered by an attacker who holds low-level (low-privileged) authentication and can reach the historian over an adjacent network, as reflected in the CVSS 4.0 vector (AV:A/PR:L). By sending crafted input to the vulnerable service, the attacker corrupts memory beyond the intended buffer and achieves remote code execution on the host running the historian. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected system, effectively full compromise of that machine, with no modeled impact spreading to the wider network. Affected users are industrial operators, OEMs/machine builders, and plant sites running FactoryTalk Historian Machine Edition; the affected version ranges are specified in Rockwell Automation's security advisory and are not stated in the source data. Exploitation has not been observed: the flaw is not in CISA's KEV, no public proof-of-concept is known, and EPSS estimates roughly a 0.3% probability of exploitation within 30 days.

What to do: Check the Rockwell Automation PSIRT advisory for CVE-2025-12768 for the exact affected version ranges and apply the vendor's recommended software/firmware update. Because exploitation requires network adjacency plus valid low-privileged credentials, restrict access to the historian's network ports (OT segmentation/firewall rules), review and rotate shared or default low-privilege accounts with access to the historian, and monitor hosts running the historian for anomalous process activity.