Rockwell Automation Verve Asset Manager Legacy ADI Server Component Plaintext Secret Vulnerability
Vulnerability
A vulnerability exists in the legacy ADI server component of Verve Asset Manager, due to plaintext secrets being stored in environment variables on the ADI server. This component has been retired and was optional since the 1.36 release in 2024.
Impact
The vulnerability allows for the insecure storage of sensitive information, with plaintext secrets being exposed in environment variables.
Remediation
Users can upgrade to Verve Asset Manager version 1.42 or later, where this component has been fully removed. For those unable to upgrade, Rockwell Automation recommends following their security best practices.
Added: Jan 20, 2026, 2:33 PM
Updated: Jan 20, 2026, 2:33 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
2.5exploitability
2.4remediation
0.0relevance
2.3threat
0.0urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.