CVE-2025-1449

CVE-2025-1449 is a high-severity vulnerability with a CVSS 4.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Description

A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing. A portion of the administrative web interface for Verve's Legacy Agentless Device Inventory (ADI) capability (deprecated since the 1.36 release) allows users to change a variable with inadequate sanitizing. If exploited, it could allow a threat actor with administrative access to run arbitrary commands in the context of the container running the service.

Frequently asked questions

What is CVE-2025-1449?
A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing. A portion of the administrative web interface for Verve's Legacy Agentless Device Inventory (ADI) capability (deprecated since the 1.36 release) allows users to change a variable with inadequate sanitizing. If exploited, it could allow a threat actor with administrative access to run arbitrary commands in the context of the container running the service.
How severe is CVE-2025-1449?
CVE-2025-1449 has a CVSS 4.0 base score of 7.5, rated high severity.
Is CVE-2025-1449 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (47th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-1449?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-1449 have an EU (EUVD) identifier?
Yes. CVE-2025-1449 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-8845.
When was CVE-2025-1449 published?
CVE-2025-1449 was published on 2025-03-31 and last updated on 2026-06-17.

References