IM
IronMonkey Threat Research

CVE-2020-25178 HIGH

Published: 2022-03-18 | Last Modified: 2024-11-21 | Status: Modified

Description

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files.

Additional Descriptions (1)

ISaGRAF Workbench es comunicado con Rockwell Automation ISaGRAF Runtime versiones 4.x y 5.x, usando TCP/IP. Este protocolo de comunicación proporciona varias operaciones del sistema de archivos, así como la carga de aplicaciones. Los datos son transferidos a través de este protocolo sin encriptar, lo que podría permitir a un atacante remoto no autenticado cargar, leer y borrar archivos

CVSS Metrics

Base Score: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 5.9

Base Score: 9.3 (HIGH)

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactCOMPLETE
Integrity ImpactCOMPLETE
Availability ImpactCOMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 10.0

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-319
[email protected] Primary
en CWE-319

Affected Products

Vendor Product Version Update Type
schneider-electric easergy_t300_firmware * <built-in method update of dict object at 0x7e60a8895f80> Operating System
schneider-electric easergy_c5_firmware * <built-in method update of dict object at 0x7e60a8897e40> Operating System
schneider-electric micom_c264_firmware * <built-in method update of dict object at 0x7e60a8896300> Operating System
schneider-electric pacis_gtw_firmware 5.1 <built-in method update of dict object at 0x7e6111c1f240> Operating System
schneider-electric pacis_gtw_firmware 5.2 <built-in method update of dict object at 0x7e60a88968c0> Operating System
schneider-electric pacis_gtw_firmware 6.1 <built-in method update of dict object at 0x7e60a8894440> Operating System
schneider-electric pacis_gtw_firmware 6.3 <built-in method update of dict object at 0x7e61109d4200> Operating System
schneider-electric pacis_gtw_firmware 6.3 <built-in method update of dict object at 0x7e60a8895240> Operating System
schneider-electric saitel_dp_firmware * <built-in method update of dict object at 0x7e61109d7b40> Operating System
schneider-electric epas_gtw_firmware 6.4 <built-in method update of dict object at 0x7e60a8896f80> Operating System
schneider-electric epas_gtw_firmware 6.4 <built-in method update of dict object at 0x7e60a8895800> Operating System
schneider-electric saitel_dr_firmware * <built-in method update of dict object at 0x7e61109d5740> Operating System
schneider-electric scd2200_firmware * <built-in method update of dict object at 0x7e61109d7bc0> Operating System
rockwellautomation aadvance_controller * <built-in method update of dict object at 0x7e60a8895c80> Application
rockwellautomation isagraf_free_runtime * <built-in method update of dict object at 0x7e60a8897f00> Application
rockwellautomation isagraf_runtime * <built-in method update of dict object at 0x7e60a8897b40> Application
rockwellautomation micro810_firmware - <built-in method update of dict object at 0x7e60a8895840> Operating System
rockwellautomation micro820_firmware - <built-in method update of dict object at 0x7e6108404400> Operating System
rockwellautomation micro830_firmware - <built-in method update of dict object at 0x7e611232c700> Operating System
rockwellautomation micro850_firmware - <built-in method update of dict object at 0x7e6108405b80> Operating System
rockwellautomation micro870_firmware - <built-in method update of dict object at 0x7e6108405f00> Operating System
xylem multismart_firmware * <built-in method update of dict object at 0x7e6111c1ca00> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*
Yes cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*
No cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*
Yes cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*

References

Notification
Message here