The vulnerabilities are missing authentication for critical function, improper neutralization of input during web page generation (cross-site scripting), and cross-site request forgery (CSRF).
Successful exploitation of these remotely exploitable vulnerabilities, which Rockwell self-reported, could result in a denial-of-service, data modification, or in an attacker obtaining sensitive information.
In one issue, multiple broken authentication security issues exist in the affected product. The security issues are due to missing authentication checks on critical functions. These could result in potential denial-of-service, admin account takeover, or NAT rule modifications. Devices would no longer be able to communicate through NATR as a result of denial-of-service or NAT rule modifications. NAT rule modification could also result in device communication to incorrect endpoints. Admin account takeover could allow modification of configuration and require physical access to restore.
CVE-2025-7328 is the case number for this vulnerability, which has a CVSS v3 base score of 10.0. There is also a CVSS v4 base score of 9.9.
Additionally, a stored cross-site scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify sensitive data or make the webpage unavailable. The vulnerability stems from missing special character filtering and encoding. Successful exploitation requires an attacker to be able to update configuration fields behind admin login.
CVE-2025-7329 is the case number for this vulnerability, which has a CVSS v3 base score of 8.4. There is also a CVSS v4 base score of 8.5.
Also, a cross-site request forgery security issue exists in the product and version listed. The vulnerability stems from missing CSRF checks on the impacted form. This allows for unintended configuration modification if an attacker can convince a logged in admin to visit a crafted link.
CVE-2025-7330 is the case number for this vulnerability, which has a CVSS v3 base score of 8.0. There is also a CVSS v4 base score of 7.0.
The product sees use mainly in the critical manufacturing sector, and on a global basis.
No exploit targets these vulnerabilities. However, an attacker could leverage these low complexity vulnerabilities.
Rockwell recommends users upgrade their devices to 1.007 or later.
Users of the affected software unable to upgrade to one of the corrected versions should follow Rockwell Automation’s security best practices.