CVE-2025-11084

A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not completed within a 7-day period.

CVSS

No CVSS.

References

Link	Resource
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1758.html

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Un problema de seguridad existe dentro de DataMosaix™ Private Cloud, permitiendo a los atacantes eludir la MFA durante la configuración y obtener una cookie de token de inicio de sesión válida sin conocer la contraseña del usuario. Esta vulnerabilidad ocurre cuando la MFA está habilitada pero no se completa en un período de 7 días.

Information

Published : 2025-11-11 14:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-11084

Mitre link : CVE-2025-11084

CVE.ORG link : CVE-2025-11084

JSON object : View

Products Affected

No product.

CWE

CWE-1390

Weak Authentication

{"id": "CVE-2025-11084", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11084", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-12T14:54:57.028772Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "PSIRT@rockwellautomation.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "PSIRT@rockwellautomation.com", "affectedData": [{"vendor": "Rockwell Automation", "product": "FactoryTalk\u00ae DataMosaix\u2122 Private Cloud", "versions": [{"status": "affected", "version": "7.11, 8.00, 8.01"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-11T14:15:34.310", "references": [{"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1758.html", "source": "PSIRT@rockwellautomation.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "PSIRT@rockwellautomation.com", "description": [{"lang": "en", "value": "CWE-1390"}]}], "descriptions": [{"lang": "en", "value": "A security issue exists within DataMosaix\u2122 Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not completed within a 7-day period."}, {"lang": "es", "value": "Un problema de seguridad existe dentro de DataMosaix\u2122 Private Cloud, permitiendo a los atacantes eludir la MFA durante la configuraci\u00f3n y obtener una cookie de token de inicio de sesi\u00f3n v\u00e1lida sin conocer la contrase\u00f1a del usuario. Esta vulnerabilidad ocurre cuando la MFA est\u00e1 habilitada pero no se completa en un per\u00edodo de 7 d\u00edas."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "PSIRT@rockwellautomation.com"}