7.5
High
CVE-2025-1449 A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing
Description
A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing. A portion of the administrative web interface for Verve's Legacy Agentless Device Inventory (ADI) capability (deprecated since the 1.36 release) allows users to change a variable with inadequate sanitizing. If exploited, it could allow a threat actor with administrative access to run arbitrary commands in the context of the container running the service.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Verve Asset Manager 1.39 | earliest → 1.39 | No fix stated |
Other CVEs of Verve Asset Manager
The 4 CVEs of Verve Asset Manager →
CVE-2025-14377
A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext…
8.8
High
CVE-2025-14376
A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext…
8.6
High
CVE-2025-11862
A security issue was discovered within Verve Asset Manager allowing unauthorized read-only users to read, update, and…
8.4
High