CVE-2025-7970 Rockwell Automation FactoryTalk Activation Manager Lack of Encryption Vulnerability
Attackers can decrypt traffic to expose data or hijack sessions in Rockwell FactoryTalk Activation Manager due to cryptographic implementation errors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-7970?
CVE-2025-7970 is a high-severity vulnerability in Rockwell Automation FactoryTalk Activation Manager, published on 9 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security issue exists within FactoryTalk Activation Manager. An error in the implementation of cryptography within the software could allow attackers to decrypt traffic. This could result in data exposure, session hijacking, or full communication compromise.
Weakness: CWE-306
Which versions are affected by CVE-2025-7970?
It affects 1 product.
Products include Rockwellautomation Factorytalk Activation Manager.
How do I fix CVE-2025-7970?
No fix has been published for CVE-2025-7970 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-7970 being exploited?
There is no known exploitation of CVE-2025-7970 in the wild and no public exploit code.
Sources
Also known as GHSA-546r-23f4-q9q4.