Verve Asset Manager
Approved changes feed: RSS · Atom
cpe:2.3:a:rockwell_automation:verve_asset_manager:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Rockwell Automation (dde15a4c-943a-57fe-888d-2bc03ade6545) |
|---|---|
| Product | Verve Asset Manager (3ee99d8c-3828-59ea-8782-cbd62fcfb227) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-1449 |
vulnerable | 2026-06-08 07:08:36.992607 |
Admin Shell Access Vulnerability in Rockwell Automation Verve Asset Manager
A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing. A portion of the administrative web interface for Verve's Legacy Agentless Device Inventory (ADI) capability (deprecated since the 1.36 release) allows users to change a variable with inadequate sanitizing. If exploited, it could allow a threat actor with administrative access to run arbitrary commands in the context of the container running the service.
Published: 2025-03-31T16:00:56.951Z
Updated: 2025-03-31T18:24:38.780Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14377 |
vulnerable | 2026-06-08 07:06:34.376563 |
Verve Asset Manager – Plaintext Storage Vulnerabilities
A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext secrets incorrectly stored when a playbook is running. This component has been retired and has been optional since the 1.36 release in 2024.
Published: 2026-01-20T13:21:40.649Z
Updated: 2026-01-20T16:09:48.026Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14376 |
vulnerable | 2026-06-08 07:06:34.376185 |
Verve Asset Manager – Plaintext Storage Vulnerabilities
A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on the ADI server. This component has been retired and has been optional since the 1.36 release in 2024.
Published: 2026-01-20T13:18:32.484Z
Updated: 2026-01-20T16:17:16.102Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11862 |
vulnerable | 2026-06-08 07:04:29.321193 |
Verve Asset Manager Access Control Vulnerability
A security issue was discovered within Verve Asset Manager allowing unauthorized read-only users to read, update, and delete users via the API.
Published: 2025-11-11T13:43:10.584Z
Updated: 2025-11-12T20:03:32.814Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.