CVEvulnerability

CVE-2025-9161

7.3 HIGH Published 2025-09-09 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-09-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
7.3 HIGH — CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77

Description

A security issue exists within FactoryTalk Optix MQTT broker due to the lack of URI sanitization. This flaw enables the loading of remote Mosquito plugins, which can be used to achieve remote code execution.

Affected configurations

• rockwellautomation factorytalk optix (>= 1.5.0 < 1.6.0)

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References