IM
IronMonkey Threat Research

CVE-2020-25180 MEDIUM

Published: 2022-03-18 | Last Modified: 2024-11-21 | Status: Modified

Description

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device.

Additional Descriptions (1)

Rockwell Automation ISaGRAF Runtime versiones 4.x y 5.x, incluyen la funcionalidad setting a password que es requerida para ejecutar comandos privilegiados. El valor de la contraseña que es pasada a ISaGRAF Runtime es el resultado de la encriptación llevada a cabo con un valor de clave fijo usando el algoritmo de encriptación diminuto (TEA) en una contraseña introducida o guardada. Un atacante remoto, no autenticado, podría pasar su propia contraseña encriptada al ISaGRAF 5 Runtime, lo que podría resultar en una divulgación de información en el dispositivo

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 4.3 (MEDIUM)

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-321
[email protected] Primary
en CWE-798

Affected Products

Vendor Product Version Update Type
schneider-electric easergy_t300_firmware * <built-in method update of dict object at 0x7e60b9fb7e00> Operating System
schneider-electric easergy_c5_firmware * <built-in method update of dict object at 0x7e60ba0ae880> Operating System
schneider-electric micom_c264_firmware * <built-in method update of dict object at 0x7e611232c300> Operating System
schneider-electric pacis_gtw_firmware 5.1 <built-in method update of dict object at 0x7e6110cf4140> Operating System
schneider-electric pacis_gtw_firmware 5.2 <built-in method update of dict object at 0x7e60b9fb5380> Operating System
schneider-electric pacis_gtw_firmware 6.1 <built-in method update of dict object at 0x7e60b9fb46c0> Operating System
schneider-electric pacis_gtw_firmware 6.3 <built-in method update of dict object at 0x7e60ba0ad080> Operating System
schneider-electric pacis_gtw_firmware 6.3 <built-in method update of dict object at 0x7e60e8815d80> Operating System
schneider-electric saitel_dp_firmware * <built-in method update of dict object at 0x7e6110cf7ec0> Operating System
schneider-electric epas_gtw_firmware 6.4 <built-in method update of dict object at 0x7e60b9fb5cc0> Operating System
schneider-electric epas_gtw_firmware 6.4 <built-in method update of dict object at 0x7e60a8be4880> Operating System
schneider-electric saitel_dr_firmware * <built-in method update of dict object at 0x7e60b9fb6900> Operating System
schneider-electric scd2200_firmware * <built-in method update of dict object at 0x7e60a8be6d00> Operating System
rockwellautomation aadvance_controller * <built-in method update of dict object at 0x7e60a8be7140> Application
rockwellautomation isagraf_free_runtime * <built-in method update of dict object at 0x7e613c4b1080> Application
rockwellautomation isagraf_runtime * <built-in method update of dict object at 0x7e6110cf6140> Application
rockwellautomation micro810_firmware - <built-in method update of dict object at 0x7e60a8be5b00> Operating System
rockwellautomation micro820_firmware - <built-in method update of dict object at 0x7e6110cf41c0> Operating System
rockwellautomation micro830_firmware - <built-in method update of dict object at 0x7e6110cf6a80> Operating System
rockwellautomation micro850_firmware - <built-in method update of dict object at 0x7e6110cf46c0> Operating System
rockwellautomation micro870_firmware - <built-in method update of dict object at 0x7e60ba2a6140> Operating System
xylem multismart_firmware * <built-in method update of dict object at 0x7e60a8be7400> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*
Yes cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*
No cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*
Yes cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*

References

Notification
Message here