Cpe:2.3:a:rockwell_automation:historian_me:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3arockwell_automationhistorian_me/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 01 Sep 2026 17:10:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCritical Vulnerabilities in Rockwell Automation Historian MEhttps://feed.craftedsignal.io/briefs/2026-09-rockwell-historian/Tue, 01 Sep 2026 17:10:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-rockwell-historian/Rockwell Automation Historian ME series B and C contain multiple vulnerabilities, including an out-of-bounds write allowing remote code execution and a buffer overflow causing denial-of-service.Rockwell Automation has disclosed two vulnerabilities affecting FactoryTalk Historian Machine Edition (ME) versions Series B 5.202 and Series C 7.101. These vulnerabilities, tracked as CVE-2025-12768 and CVE-2026-12661, expose critical infrastructure to severe operational risks. CVE-2025-12768 is an out-of-bounds write vulnerability (CWE-787) that allows an authenticated attacker with low-level access to achieve remote code execution. CVE-2026-12661 is a stack-based buffer overflow (CWE-121) triggered by crafted requests sent to the web interface, which can lead to a device crash and denial-of-service conditions. These vulnerabilities impact diverse sectors, including water, healthcare, food production, and manufacturing. Given the critical nature of these industrial control systems, defenders must prioritize network isolation and ensure administrative access controls are rigorously enforced to prevent unauthorized exploitation.

Impact

Successful exploitation of these vulnerabilities could result in full system compromise via remote code execution (CVE-2025-12768) or the loss of availability through forced device crashes (CVE-2026-12661). These systems are deployed in vital critical infrastructure sectors, including chemical processing, healthcare, and water systems. If compromised, attackers could potentially manipulate industrial processes or render safety-critical monitoring systems unresponsive. No known public exploitation has been reported as of September 2026.

Recommendation

Prioritize the following actions to secure affected Rockwell Automation Historian ME environments:

  • Immediately isolate all affected Historian ME controllers behind firewalls and restrict access to the web interface to authorized management subnets only.
  • Contact Rockwell Automation TechConnect for guidance on obtaining and deploying the latest firmware or software patches for Series B 5.202 and Series C 7.101.
  • Monitor network traffic to the device web interface for anomalous, malformed, or excessively large HTTP requests that may indicate exploitation attempts for CVE-2026-12661.
  • Review all existing authenticated user accounts on the affected Historian ME devices to identify and disable unauthorized or dormant low-level accounts that could be leveraged for CVE-2025-12768.
]]>highadvisory