CVE-2025-9063

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access to the PanelView Plus 7 Series B, including access to the file system, retrieval of diagnostic information, event logs, and more.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Rockwell Automation	PanelView Plus 7 Performance Series B	V14.00

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1753.htmlVendor Advisory

Timeline

Published: Oct 14, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-90649.1A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as th CVE-2025-90658.8A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. CVE-2025-90668.7A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can CVE-2025-90677.8A security issue exists within the x86 Microsoft Installer File (MSI), installed with FTLinx. Authenticated attackers with valid Windows use CVE-2025-90687.8A security issue exists within the Rockwell Automation Driver Package x64 Microsoft Installer File (MSI) repair functionality, installed wit CVE-2025-90712.3Erroneously using an all-zero seed for RSA-OEAP padding instead of the generated random bytes, in Oberon microsystems AG’s Oberon PSA Crypto CVE-2025-90725.4Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker CVE-2025-90737.5The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including CVE-2025-90749.3A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configur CVE-2025-90756.4The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to, and includ CVE-2025-90766.5Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows ma CVE-2025-90776.4The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the T