Rockwell Verve Asset Manager Access Control Vulnerability
Plan Patch9.9SD1759Nov 11, 2025
Summary
Rockwell Verve Asset Manager (all versions) contains an access control bypass vulnerability that allows unauthenticated attackers to access the system and view or modify asset information. The vulnerability is in the authentication mechanism of the application, enabling remote attackers to circumvent access controls without providing valid credentials. This affects all released versions of the product. No patch is currently available from Rockwell Automation.
What this means
What could happen
An attacker with network access to Verve Asset Manager could bypass access controls and view or modify critical asset data, configuration, and operational parameters without proper authentication.
Who's at risk
This vulnerability affects utilities and industrial facilities using Rockwell Verve Asset Manager to track and manage operational technology assets—including remote terminal units (RTUs), programmable logic controllers (PLCs), switches, and other field devices. Any organization relying on Verve for asset visibility and integrity should prioritize this.
How it could be exploited
An attacker sends a crafted network request to the Verve Asset Manager interface to bypass authentication checks. Once access is gained, the attacker can read sensitive configuration data, modify asset parameters, or retrieve operational intelligence about connected devices and systems.
Prerequisites
- Network reachability to Verve Asset Manager web or API interface
- No valid credentials required due to authentication bypass
remotely exploitableno authentication requiredcritical severity (CVSS 9.9)affects asset management and configurationno patch availableimpacts OT visibility and control
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (1)
ProductAffected VersionsFix Status
Verve Asset ManagerAll versionsNo fix (EOL)
Remediation & Mitigation
0/4
Do now
0/3WORKAROUNDRestrict network access to Verve Asset Manager to authorized engineering workstations and control network segments using firewall rules or network segmentation
HARDENINGImplement network-level authentication (e.g., VPN or mutual TLS) for all connections to Verve Asset Manager until a vendor patch is available
WORKAROUNDContact Rockwell Automation to request timeline and availability of a patch; escalate if no fix is planned for this critical vulnerability
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HARDENINGMonitor all access and API calls to Verve Asset Manager for suspicious activity; log and alert on authentication bypass attempts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/ee619e4b-2069-4bba-a4a0-2cb45ce0ff5a