Vulnerabilities
Rockwell Automation Historian ME Exposes Remote Code Execution & DoS via Out‑of‑Bounds Buffer Overflows
Two high‑severity vulnerabilities in Rockwell Automation’s FactoryTalk Historian Machine Edition (Historian ME) allow attackers with low‑level authentication to crash the device or, in one case, execute arbitrary code. Affected Series B 5.202 and Series C 7.101 are impacted. The flaws, CVE‑2025‑12768 and CVE‑2026‑12661, pose a risk to critical infrastructure sectors worldwide. Immediate mitigation is advised, with upgrade or adherence to Rockwell’s security best practices. Contact the PSIRT team at [email protected] for assistance.
Rockwell Automation’s FactoryTalk Historian Machine Edition (Historian ME) has been hit by two high‑severity flaws that could let a low‑privilege attacker crash the device or, in one case, run arbitrary code.
Affected Versions
- Series B 5.202 – CVE‑2025‑12768, CVE‑2026‑12661
- Series C 7.101 – CVE‑2025‑12768, CVE‑2026‑12661
Impact
- Out‑of‑bounds write (CWE‑787) that can trigger a stack‑based buffer overflow.
- Remote code execution for users with low‑level authentication (CVE‑2025‑12768).
- Denial‑of‑service via crafted web requests causing device crash (CVE‑2026‑12661).
Critical Infrastructure Sectors
- Chemical
- Critical Manufacturing
- Food & Agriculture
- Healthcare & Public Health
- Water & Wastewater
Mitigation
If an upgrade to a patched release is not immediately possible, follow Rockwell’s security best practices. For guidance, reach out to TechConnect or the PSIRT team. The PSIRT email is [email protected].
Contact
Rockwell Automation PSIRT – [email protected]
Related vulnerabilities
Hitachi Energy REB500: CVE‑2024‑8176 & CVE‑2025‑59375 Enable DoS via IEC61850
Hitachi Energy REB500 versions ≤8.3.3.1 suffer two libexpat flaws (CVE‑2024‑8176 and CVE‑2025‑59375) that can be leveraged by authenticated users to trigger a denial‑of‑service. The vendor has released a patch to 8.3.4.0; operators should update immediately and monitor IEC61850 traffic.
Read briefing
CVE‑2025‑50165: Critical Windows Imaging Component RCE via Crafted JPEG
Microsoft’s WindowsCodecs.dll contains CVE‑2025‑50165, a critical flaw that can trigger remote code execution when a specially crafted JPEG is processed. The vulnerability is in the jpeg_finish_compress routine, and while Microsoft rates it critical, exploitability is considered low. Defenders should apply the latest Windows updates, disable unnecessary image processing on servers, and monitor for anomalous JPEG handling.
Read briefing
TrendAI Apex One Local Privilege Escalation via Incomplete Cleanup (CVE-2025-71414)
A local privilege escalation flaw in TrendAI Apex One Security Agent allows attackers who can run low‑privileged code to gain SYSTEM rights by exploiting improper cleanup in the TmccCore component. The CVE‑2025‑71414 vulnerability has a CVSS score of 7.8. Defenders should patch immediately and monitor for suspicious process termination events.
Read briefing
CVE-2025-48927: TeleMessage SGNL Heapdump Leak Vulnerability Remediated, No Exploitation Detected
TeleMessageTM SGNL, an enterprise messaging platform, suffered a CVE-2025-48927 flaw that exposed a public /heapdump endpoint, potentially leaking 150 MB of heap memory containing plaintext credentials. The issue was fully remediated in early May 2025, with independent verification and no customer action required. Defenders should confirm their deployments are patched, disable actuator endpoints, and monitor GreyNoise feeds for related reconnaissance activity.
Read briefing