---
title: "Rockwell Automation Verve Asset Manager Flaws Expose Sensitive Data"
short_title: "Rockwell Verve Asset Manager security flaws exposed"
description: "Two high-severity vulnerabilities in Rockwell Automation Verve Asset Manager (CVE-2025-14376, CVE-2025-14377) risk sensitive data exposure. Learn mitigation steps now."
author: "Vitus"
date: 2025-01-24
categories: [Cybersecurity, Vulnerabilities]
tags: [rockwell automation, cve-2025-14376, cve-2025-14377, data breach, ot security]
score: 0.78
cve_ids: [CVE-2025-14376, CVE-2025-14377]
---
TL;DR
Rockwell Automation Verve Asset Manager contains two high-severity vulnerabilities (CVE-2025-14376 and CVE-2025-14377) that could allow attackers to access sensitive information stored in plaintext. The flaws affect multiple versions of the software, but patches and mitigations are available. Organizations using critical manufacturing systems should update immediately to prevent exploitation.
---
Main Content
Introduction
Rockwell Automation, a global leader in industrial automation and digital transformation, has disclosed two high-severity vulnerabilities in its Verve Asset Manager. These flaws, identified as CVE-2025-14376 and CVE-2025-14377, involve insecure storage of sensitive information and could expose critical data to malicious actors. Given the software's widespread use in critical manufacturing sectors, organizations must act swiftly to mitigate risks and secure their systems.
---
Key Points
- Two high-severity vulnerabilities (CVE-2025-14376 and CVE-2025-14377) affect multiple versions of Rockwell Automation Verve Asset Manager.
- Insecure storage of sensitive data in environment variables and Ansible playbooks could lead to unauthorized access.
- Affected versions include 1.33 through 1.41.3, with patches available in version 1.42.
- Critical manufacturing sectors worldwide are at risk, particularly those relying on operational technology (OT) systems.
- No known public exploitation has been reported, but proactive measures are strongly recommended.
---
Technical Details
#### Vulnerability Breakdown
1. CVE-2025-14376 (Insecure Storage of Sensitive Information)
- CVSS Score: 7.2 (High)
- Vector: `CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N`
- Description: A flaw in the legacy ADI server component of Verve Asset Manager stores sensitive data in unencrypted environment variables. This component was retired and made optional starting with version 1.36 (2024).
- Relevant CWE: [CWE-922: Insecure Storage of Sensitive Information](https://cwe.mitre.org/data/definitions/922.html)
2. CVE-2025-14377 (Cleartext Storage of Sensitive Information)
- CVSS Score: 7.9 (High)
- Vector: `CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L`
- Description: The legacy Ansible playbook component of Verve Asset Manager incorrectly stores sensitive information in cleartext during playbook execution. This component was also retired and made optional in version 1.36.
- Relevant CWE: [CWE-312: Cleartext Storage of Sensitive Information](https://cwe.mitre.org/data/definitions/312.html)
#### Affected Systems
The vulnerabilities impact the following versions of Rockwell Automation Verve Asset Manager:
- 1.33, 1.34, 1.35, 1.36, 1.37, 1.38, 1.39, 1.40, 1.41, 1.41.1, 1.41.2, and 1.41.3.
---
Impact Assessment
Successful exploitation of these vulnerabilities could allow attackers to:
- Access sensitive information stored in environment variables or Ansible playbooks.
- Compromise critical manufacturing systems, leading to operational disruptions or data breaches.
- Exfiltrate credentials or configuration data, enabling further attacks on connected OT systems.
Given the global deployment of Verve Asset Manager in critical infrastructure, the potential impact is significant. Organizations must prioritize patching and mitigation to avoid unauthorized access and potential sabotage.
---
Mitigation Steps
Rockwell Automation has provided the following recommendations to address these vulnerabilities:
1. Update to the Latest Version
- Upgrade to Verve Asset Manager version 1.42 or later, where the vulnerabilities have been resolved.
2. Disable Legacy Components
- If upgrading is not immediately possible, disable the legacy ADI server and Ansible playbook components, which have been optional since version 1.36.
3. Network Segmentation
- Isolate control system networks from business networks using firewalls and demilitarized zones (DMZs).
- Ensure OT systems are not accessible from the internet.
4. Secure Remote Access
- Use virtual private networks (VPNs) for remote access, ensuring they are updated to the latest version.
- Implement multi-factor authentication (MFA) for all remote connections.
5. Monitor for Suspicious Activity
- Deploy intrusion detection systems (IDS) to monitor for unusual activity.
- Follow CISA’s recommended practices for control systems security, including [Defense-in-Depth Strategies](https://www.cisa.gov/resources-tools/services/defense-depth-strategies).
6. Contact Support
- For further assistance, reach out to Rockwell Automation TechConnect or consult their [security advisory page](https://www.rockwellautomation.com/security).
---
Conclusion
The discovery of CVE-2025-14376 and CVE-2025-14377 in Rockwell Automation Verve Asset Manager underscores the critical importance of securing OT systems in manufacturing environments. While no active exploitation has been reported, the high-severity nature of these vulnerabilities demands immediate action. Organizations must patch affected systems, disable legacy components, and implement robust security measures to mitigate risks.
Proactive cybersecurity practices, such as network segmentation and secure remote access, are essential to safeguarding critical infrastructure from evolving threats. Stay vigilant, monitor for updates, and prioritize the security of your operational technology systems.
---
References
[^1]: CISA. "[ICS Advisory (ICSA-26-020-03): Rockwell Automation Verve Asset Manager](https://www.cisa.gov/news-events/ics-advisories/icsa-26-020-03)". Retrieved 2025-01-24.
[^2]: Rockwell Automation. "[Security Advisory for Verve Asset Manager](https://www.rockwellautomation.com/security)". Retrieved 2025-01-24.
[^3]: MITRE. "[CWE-922: Insecure Storage of Sensitive Information](https://cwe.mitre.org/data/definitions/922.html)". Retrieved 2025-01-24.
[^4]: MITRE. "[CWE-312: Cleartext Storage of Sensitive Information](https://cwe.mitre.org/data/definitions/312.html)". Retrieved 2025-01-24.