CVE-2025-14376highCWE-922

CVE-2025-14376: high-severity vulnerability in Rockwell Automation Verve Asset Manager

Verve Asset Manager – Plaintext Storage Vulnerabilities

Published

Follow this CVE+ Monitor Verve Asset Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.1%
A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on the ADI server. This component has been retired and has been optional since the 1.36 release in 2024.
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
Affected products
Rockwell Automation · Verve Asset Manager
Related CVEs — Rockwell Automation Verve Asset Manager

In the same product, most dangerous first.

CVE-2025-1449HIGHAdmin Shell Access Vulnerability in Rockwell Automation Verve Asset ManagerEPSS 0.7%CVE-2025-11862HIGHVerve Asset Manager Access Control VulnerabilityEPSS 0.3%CVE-2025-14377HIGHVerve Asset Manager – Plaintext Storage VulnerabilitiesEPSS 0.2%