Description
A security issue exists within the Rockwell Automation Driver Package x64 Microsoft Installer File (MSI) repair functionality, installed with FTLinx. Authenticated attackers with valid Windows Users credentials can initiate a repair and hijack the resulting console window for vbpinstall.exe. This allows the launching of a command prompt running with SYSTEM-level privileges, allowing full access to all files, processes, and system resources.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rockwell Automation | FactoryTalk Linx | 6.40 and prior | — |
Advisories 3
- NCSC-2025-0345 Kwetsbaarheden verholpen in Rockwell Automation FactoryTalk NCSC-NL (Netherlands) · Oct 31, 2025
- ICSA-25-289-02 Rockwell Automation FactoryTalk Linx CISA ICS & IT advisories · Oct 23, 2025
- WID-SEC-2025-2273 Rockwell Automation FactoryTalk (View Point, View Machine, Linx): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 14, 2025