CISA flags two vulnerabilities in Rockwell Automation Historian ME
CISA issued an advisory on Rockwell Automation Historian ME that covers two vulnerabilities in affected versions Series B 5.202 and Series C 7.101.
CISA on Sept. 1 published an advisory on Rockwell Automation Historian ME listing two vulnerabilities in affected Series B 5.202 and Series C 7.101 versions.
One issue could allow remote code execution on the affected device. The other could let an authenticated attacker send crafted requests to the web interface and crash the system. CISA said the product is used across multiple critical infrastructure sectors, including Chemical, Critical Manufacturing, Food and Agriculture, Healthcare and Public Health, and Water and Wastewater Systems.
For CVE-2025-12768, CISA said an attacker with low-level authentication could exploit a security issue in FactoryTalk Historian Machine Edition to achieve remote code execution on the affected device. CISA mapped the flaw to CWE-787, or out-of-bounds write, and gave it a CVSS 3.1 base score of 8.0, rated High. The agency also listed a CVSS 4.0 base score of 8.6, also High.
For CVE-2026-12661, CISA said a network-adjacent authenticated attacker could send crafted requests to the web interface, causing buffer overflow conditions that may crash the device and make it unresponsive. CISA mapped that issue to CWE-121, or stack-based buffer overflow, and rated it CVSS 3.1 base score 4.5, Medium. The agency also listed a CVSS 4.0 base score of 4.8, Medium.
CISA said Rockwell Automation reported the vulnerabilities to the agency. It also said no known public exploitation specifically targeting these issues has been reported to CISA at this time.
The advisory lists the product as deployed worldwide and says Rockwell Automation is headquartered in the United States. CISA said users should follow Rockwell Automation security best practices, contact TechConnect, or email PSIRT at [email protected] for questions about the disclosure.
CISA also recommended minimizing network exposure for control system devices and systems, isolating control system networks and remote devices behind firewalls and away from business networks, and using VPNs for remote access where needed and keeping them updated.
The advisory remains the agency’s main public notice for the affected Historian ME versions.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()