Rockwell Automation FactoryTalk Linx Privilege Escalation Vulnerabilities via MSI Repair Functionality

Rockwell Automation has disclosed two high-severity privilege escalation vulnerabilities affecting its FactoryTalk Linx software, specifically related to the Microsoft Installer (MSI) repair functionality. The vulnerabilities, tracked as CVE-2025-9067 and CVE-2025-9068, impact both the x86 and x64 versions of the FactoryTalk Linx driver package. Authenticated attackers with valid Windows user credentials can exploit these flaws by initiating a repair operation on the MSI installer. During this process, the attacker can hijack the resulting console window, which is associated with the vbpinstall.exe process. This hijacking enables the attacker to launch a command prompt with SYSTEM-level privileges, granting them full access to all files, processes, and system resources on the affected system. The vulnerabilities are not remotely exploitable, requiring local access and valid credentials to carry out the attack. Rockwell Automation has acknowledged the issue and published a security advisory (SD1754) on October 14, 2025, outlining the risks and available mitigations. As of the advisory's publication, no official patch or correction has been released, but workarounds are available to reduce the risk of exploitation. The vulnerabilities have not been reported as known to be exploited in the wild at the time of disclosure. Both CVE-2025-9067 and CVE-2025-9068 were assigned a high CVSS score of 8.5, reflecting the significant risk posed by potential privilege escalation. The advisory emphasizes the importance of restricting access to systems running FactoryTalk Linx and ensuring that only trusted users have local access. Organizations are encouraged to review the provided workarounds and monitor for future updates regarding patches or permanent fixes. The vulnerabilities highlight the ongoing risks associated with installer repair functionalities, which can be abused for privilege escalation if not properly secured. Rockwell Automation's Product Security Incident Response Team (PSIRT) is the source of the vulnerability disclosures. The affected product versions have not been explicitly listed, but all users of FactoryTalk Linx are advised to assess their exposure. The advisory is part of Rockwell Automation's commitment to transparency and proactive security communication with its customers. Industrial organizations using FactoryTalk Linx should prioritize reviewing their security posture in light of these vulnerabilities. The disclosure underscores the need for robust access controls and monitoring on critical industrial automation systems. Ongoing vigilance and timely application of mitigations are essential to prevent potential exploitation of these privilege escalation flaws.