Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP token validation. This bypass allows access to create, update, and delete FTLinx drivers.

CVE-2025-7972 is a high-severity vulnerability affecting Rockwell Automation's FactoryTalk® Linx software, specifically versions prior to 6.50. FactoryTalk Linx is a critical industrial automation communication platform widely used in manufacturing and process control environments. The vulnerability arises from incorrect user management (CWE-286) within the FactoryTalk Linx Network Browser component. An attacker can exploit this flaw by modifying the environment variable process.env.NODE_ENV to 'development'. This manipulation disables the FTSP (FactoryTalk Security Protocol) token validation mechanism, which is designed to authenticate and authorize user actions. By bypassing this token validation, the attacker gains unauthorized capabilities to create, update, and delete FactoryTalk Linx drivers, which are essential for communication between the control system and industrial devices. The CVSS 4.0 base score of 8.4 reflects a high-severity rating, with the vector indicating local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and no confidentiality impact (VC:N), but high impact on integrity (VI:H) and availability (VA:H). The scope is unchanged (SC:N), but the impact is significant due to the ability to manipulate drivers, potentially disrupting industrial processes or injecting malicious configurations. No known exploits are currently reported in the wild, and no patches are yet available. This vulnerability highlights a critical security design flaw where environment variables can be leveraged to disable essential security controls, posing a serious risk to industrial control systems relying on FactoryTalk Linx.

Detailed information about CVE-2025-7972: CWE-286: Incorrect User Management in Rockwell Automation FactoryTalk® Linx affecting Rockwell Automation FactoryTalk®

CVE-2025-7972: CWE-286: Incorrect User Management in Rockwell Automation FactoryTalk® Linx - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-7972: CWE-286: Incorrect User Management in Rockwell Automation FactoryTalk® Linx

Threats Tagged 'cve-2025-7972'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-7972'

Lead Pen Test Professional