CVE-2025-9036

A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and can be intercepted by any local client listening on the connection.

Score

CVSS 4.0 8.5 High

Status

Deferred - PSIRT@rockwellautomation.com

Published

2025-08-14

Last modified

2025-08-14

Weaknesses

CWE-200

Affected products

• Factorytalk Action Manager (Rockwell Automation)

References

• https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1740.html