CVE-2025-9161

7.3 highEPSS 0.6%

High (7.3) in rockwellautomation factorytalk optix. EPSS 0.6% chance of exploitation in the next 30 days.

A security issue exists within FactoryTalk Optix MQTT broker due to the lack of URI sanitization. This flaw enables the loading of remote Mosquito plugins, which can be used to achieve remote code execution.

Severity

CVSS 4.0

7.3 high

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-77
Published: 2025-09-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rockwellautomation:factorytalk_optix

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1742.html

Check your stack JSON