High severity · published Jan 28, 2025
CVE-2025-0659
Path Traversal and Rockwell Automation Third-party Vulnerability in DataMosaix™ Private Cloud
7.0
CVSS
0.4%
EPSS
No
On KEV
Description
A path
traversal vulnerability exists in the Rockwell Automation DataEdge Platform DataMosaix Private Cloud. By specifying the character
sequence in the body of the vulnerable endpoint, it is possible to overwrite
files outside of the intended directory. A threat actor with admin privileges could
leverage this vulnerability to overwrite reports including user projects.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
DataEdgePlatform DataMosaix™ Private Cloud · Rockwell Automation
<=7.11 · source: vendor
Affected product
DD
DataEdgePlatform DataMosaix™ Private Cloud
Rockwell Automation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0659
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0659
www.rockwellautomation.com
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1715.html
More from DataEdgePlatform DataMosaix™ Private Cloud
8.7
CVE-2024-7953
DataEdgePlatform DataMosaix™ Private Cloud
8.7
CVE-2024-7952
DataEdgePlatform DataMosaix™ Private Cloud
