CVE-2025-9161: Rockwell Automation FactoryTalk Optix Remote Code Execution Vulnerability
Published Sep 9, 2025
·Updated
A security issue exists within FactoryTalk Optix MQTT broker due to the lack of URI sanitization. This flaw enables the loading of remote Mosquito plugins, which can be used to achieve remote code execution.
Affected Software
2 affected components
Rockwell Automation FactoryTalk Optix
rockwellautomation Factorytalk Optix>=1.5.0<1.6.0
Event History
Sep 9, 2025
CVE Published
via MITRE·12:57 PM
Data Sourced
via MITRE·12:57 PM
DescriptionWeakness
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Feb 28, 57989
Event
via FIRST·07:48 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-9161?
CVE-2025-9161 is a critical severity vulnerability due to its potential for remote code execution.
2
What causes CVE-2025-9161?
CVE-2025-9161 is caused by a lack of URI sanitization in the FactoryTalk Optix MQTT broker.
3
How can I fix CVE-2025-9161?
To fix CVE-2025-9161, ensure that you apply the latest security patches provided by Rockwell Automation for FactoryTalk Optix.
4
Which software versions are affected by CVE-2025-9161?
CVE-2025-9161 affects all versions of Rockwell Automation FactoryTalk Optix that utilize the MQTT broker.
5
What are the potential consequences of exploiting CVE-2025-9161?
Exploiting CVE-2025-9161 could allow an attacker to execute arbitrary remote code on the affected system.