Critical severity · published Mar 18, 2022
CVE-2020-25176
Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system
9.8
CVSS
6.4%
EPSS
No
On KEV
Description
Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Aadvance Controller · Rockwellautomation
through 1.40 · source: NVD
EC
Easergy C5 Firmware · Schneider-electric
before 1.1.0 · source: NVD
ET
Easergy T300 Firmware · Schneider-electric
through 2.7.1 · source: NVD
EG
Epas Gtw Firmware · Schneider-electric
6.4; 6.4 · source: NVD
IF
Isagraf Free Runtime · Rockwellautomation
through 6.6.8 · source: NVD
IR
Isagraf Runtime · Rockwellautomation
5.0 before 6.0 · source: NVD
MC
Micom C264 Firmware · Schneider-electric
before d6.1 · source: NVD
MF
Micro810 Firmware · Rockwellautomation
All versions, or not specified · source: NVD
MF
Micro820 Firmware · Rockwellautomation
All versions, or not specified · source: NVD
MF
Micro830 Firmware · Rockwellautomation
All versions, or not specified · source: NVD
MF
Micro850 Firmware · Rockwellautomation
All versions, or not specified · source: NVD
MF
Micro870 Firmware · Rockwellautomation
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25176
Mitigation
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
Permissions Required
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
Third Party Advisory
https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
More from Aadvance Controller
8.8
CVE-2020-25178
ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP
6.7
CVE-2020-25182
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries
6.5
CVE-2020-25180
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands
5.5
CVE-2020-25184
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file