CVE-2025-0659: Path Traversal and Rockwell Automation Third-party Vulnerability in DataMosaix™ Private Cloud
First published: Tue Jan 28 2025(Updated: )
A path traversal vulnerability exists in the Rockwell Automation DataEdge Platform DataMosaix Private Cloud. By specifying the character sequence in the body of the vulnerable endpoint, it is possible to overwrite files outside of the intended directory. A threat actor with admin privileges could leverage this vulnerability to overwrite reports including user projects.
Credit: PSIRT@rockwellautomation.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwell Automation DataMosaix Private Cloud |
Remedy
Corrected in software version 7.11.01 and later.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-0659?
CVE-2025-0659 is classified as a high-severity vulnerability due to its potential to allow unauthorized file overwrites.
How do I fix CVE-2025-0659?
To fix CVE-2025-0659, ensure that you update to the latest secure version of the Rockwell Automation DataMosaix Private Cloud.
What systems are affected by CVE-2025-0659?
CVE-2025-0659 affects the Rockwell Automation DataMosaix Private Cloud platform.
Who is vulnerable to CVE-2025-0659?
Any organization utilizing the vulnerable versions of the Rockwell Automation DataMosaix Private Cloud is at risk of CVE-2025-0659.
What can happen if CVE-2025-0659 is exploited?
If exploited, CVE-2025-0659 enables an attacker to overwrite sensitive files outside the intended directory, potentially compromising the system.
- agent/remedy
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/source
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/rockwell automation
- canonical/rockwell automation datamosaix private cloud