CVE-2025-1449 — Admin Shell Access Vulnerability in Rockwell Automation Verve Asset Manager
A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing. A portion of the administrative web interface for Verve's Legacy A…
Published: 2025-03-31 · CVSS: 7.5 · CVSS 4.0
A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing. A portion of the administrative web interface for Verve's Legacy Agentless Device Inventory (ADI) capability (deprecated since the 1.36 release) allows users to change a variable with inadequate sanitizing. If exploited, it could allow a threat actor with administrative access to run arbitrary commands in the context of the container running the service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7