VulnerabilityAnalyzed

CVE-2025-7330

A cross-site request forgery security issue exists in the product and version listed.

HIGH 7.0EPSS 0.19%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.19%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A cross-site request forgery security issue exists in the product and version listed. The vulnerability stems from missing CSRF checks on the impacted form. This allows for unintended configuration modification if an attacker can convince a logged in admin to visit a crafted link.

CVSS 4.0: 7.0 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.19% probability · 9th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: rockwellautomation/1783-natr firmware
Source: PSIRT@rockwellautomation.com

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1756.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.