Critical severity · published Mar 18, 2022
CVE-2020-25176
Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal
9.8
CVSS
6.4%
EPSS
No
On KEV
Description
Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IR
ISaGRAF Runtime · Rockwell Automation
4.x; 5.x · source: vendor, NVD
AC
Aadvance Controller · Rockwellautomation
through 1.40 · source: NVD
EC
Easergy C5 Firmware · Schneider-electric
before 1.1.0 · source: NVD
ET
Easergy T300 Firmware · Schneider-electric
through 2.7.1 · source: NVD
EG
Epas Gtw Firmware · Schneider-electric
6.4; 6.4 · source: NVD
IF
Isagraf Free Runtime · Rockwellautomation
through 6.6.8 · source: NVD
MC
Micom C264 Firmware · Schneider-electric
before d6.1 · source: NVD
MF
Micro810 Firmware · Rockwellautomation
All versions, or not specified · source: NVD
MF
Micro820 Firmware · Rockwellautomation
All versions, or not specified · source: NVD
MF
Micro830 Firmware · Rockwellautomation
All versions, or not specified · source: NVD
MF
Micro850 Firmware · Rockwellautomation
All versions, or not specified · source: NVD
MF
Micro870 Firmware · Rockwellautomation
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25176
Mitigation
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
Permissions Required
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
Third Party Advisory
https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
More from ISaGRAF Runtime
8.8
CVE-2020-25178
Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Information
6.7
CVE-2020-25182
Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element
6.5
CVE-2020-25180
Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key
5.5
CVE-2020-25184
Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials