CVE-2025-14272: Rockwell Automation FactoryTalk Analytics PavilionX
A security issue was identified in Pavilion due to improper authorization enforcement in API endpoints. This vulnerability can allow an unauthorized actor to execute privileged operations, including user/role management and other administrative actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to Rockwell Automation FactoryTalk Analytics PavilionX administrative and API endpoints to trusted management networks and IP addresses using network ACLs and perimeter/host firewalls; require VPN or jump-host access for administrators and remove direct Internet exposure.
- Compensating control
Place PavilionX behind a reverse proxy, WAF, or other request-filtering gateway to block and inspect unauthorized API calls to administrative endpoints until a vendor fix is available.
- Operational
Audit PavilionX user and role accounts and recent administrative activity for signs of unauthorized changes; revert any unauthorized user/role modifications and restore intended privileges.
- Operational
Rotate credentials and API keys for all administrative accounts and any service accounts that can perform privileged actions in PavilionX; invalidate existing sessions/tokens after rotation.
- Operational
Enable or increase logging and monitoring of PavilionX administrative and API activity and create alerts for suspicious privileged operations (user/role changes, new admin accounts, privilege escalations) while awaiting a vendor-provided patch.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14272?
The severity of CVE-2025-14272 is rated as high with a score of 8.3.
How do I fix CVE-2025-14272?
To fix CVE-2025-14272, ensure that proper authorization enforcement is applied to API endpoints in the Rockwell Automation FactoryTalk Analytics PavilionX.
What types of operations can be affected by CVE-2025-14272?
CVE-2025-14272 can allow unauthorized actors to execute privileged operations such as user and role management.
Is exploitation of CVE-2025-14272 easy for attackers?
Exploitation of CVE-2025-14272 may be relatively straightforward as it involves improper authorization enforcement.
What impact could CVE-2025-14272 have on my system?
CVE-2025-14272 could lead to unauthorized administrative actions, potentially compromising the security of user and role management in your system.