CVE-2025-7328

The vulnerabilities result from the lack of authentication mechanisms (CWE-306) protecting critical device functions. An unauthenticated attacker can remotely invoke these functions directly without providing any credentials. As a result, it is possible to take over the administrator account, modify network address translation (NAT) rules, or cause the device to enter a denial-of-service state. Modification of NAT rules can redirect network traffic to incorrect endpoints, disrupting communication of industrial devices.

An attacker can completely take over the administrator account and change device configuration, block communication through NATR via denial-of-service, or redirect network traffic to unauthorized endpoints. Restoring the device after administrator account takeover may require physical access to the hardware.

Patches available from the manufacturer should be applied in accordance with the references — details in the Rockwell Automation security bulletin SD1756 available at: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1756.html

Rockwell Automation 1783-NATR and 1783-NATR firmware — versions indicated in the manufacturer's references