Both issues live on the same web interface and behind the same login. The out-of-bounds write is described as reachable by an attacker with low-level authentication, and the advisory says that path leads to remote code execution on the device [2]. The crash needs an authenticated, network-adjacent attacker sending crafted requests to that interface [3]. At each site, the useful question is who already holds a Historian ME credential and where that credential is written down, not how severe the flaw sounds on paper.
The Metrics sections arrive empty in the published text, so there is no CVSS vector or base score to sort on [7]. That does not hold up triage. An out-of-bounds write on an embedded web service with a low authentication bar is a workable exploitation target [2], and the crash bug carries the same precondition, so it changes nothing in the priority order [3]. The write is where the priority attention belongs.
The fix is the part that will stall teams. Rockwell's remediation text addresses customers who are not able to upgrade to one of the corrected versions and points them at the vendor's security best practices document, with TechConnect and PSIRT for questions [5]. The corrected version numbers do not appear in the advisory text [6]. Two CVE IDs against two affected series produces four product-and-identifier combinations to match in an asset inventory, and all four are missing a target version [11]. The advisory also lists both IDs against both series without saying which ID is the write and which is the crash [10], so a tracker keyed on CVE cannot tell an operator whether a given row is a data gap or a shell.
CISA's guidance in the advisory is the standard set: keep control system devices off the internet, put them behind firewalls and away from business networks, and use VPNs for remote access while treating the VPN as only as secure as the devices attached to it [9]. Boilerplate, and with no version to move to, it is the operative instruction.
Rockwell reported both flaws to CISA itself, and the advisory makes no claim of exploitation [8]. This reads as a vendor disclosure, with nothing in the record pointing to a live campaign. What earns it a ticket is placement. A machine-edition historian exists to collect process data and hand it to people who are not on the process network, which is precisely where a low-privilege account tends to exist already. Five critical infrastructure sectors are named in the background section [12]. Until a corrected version is published, exposure shrinks only through enumeration of every account that can authenticate to the device.
