IM
IronMonkey Threat Research

CVE-2020-25182 MEDIUM

Published: 2022-03-18 | Last Modified: 2024-11-21 | Status: Modified

Description

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft Windows systems.

Additional Descriptions (1)

Rockwell Automation ISaGRAF Runtime Versiones 4.x y 5.x, busca y carga DLLs como bibliotecas dinámicas. Una carga no controlada de bibliotecas dinámicas podría permitir a un atacante local no autenticado ejecutar código arbitrario. Esta vulnerabilidad sólo afecta a ISaGRAF Runtime cuando es ejecutado en sistemas Microsoft Windows

CVSS Metrics

Base Score: 6.7 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 0.8

Impact Score: 5.9

Base Score: 4.6 (MEDIUM)

AV:L/AC:L/Au:N/C:P/I:P/A:P

Access VectorLOCAL
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 6.4

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-427
[email protected] Primary
en CWE-427

Affected Products

Vendor Product Version Update Type
schneider-electric easergy_t300_firmware * <built-in method update of dict object at 0x7e6111c1c200> Operating System
schneider-electric easergy_c5_firmware * <built-in method update of dict object at 0x7e6111c1eac0> Operating System
schneider-electric micom_c264_firmware * <built-in method update of dict object at 0x7e60bacd5480> Operating System
schneider-electric pacis_gtw_firmware 5.1 <built-in method update of dict object at 0x7e60bae4a800> Operating System
schneider-electric pacis_gtw_firmware 5.2 <built-in method update of dict object at 0x7e6111c1e8c0> Operating System
schneider-electric pacis_gtw_firmware 6.1 <built-in method update of dict object at 0x7e60bae49340> Operating System
schneider-electric pacis_gtw_firmware 6.3 <built-in method update of dict object at 0x7e60bacd43c0> Operating System
schneider-electric pacis_gtw_firmware 6.3 <built-in method update of dict object at 0x7e60bacd6300> Operating System
schneider-electric saitel_dp_firmware * <built-in method update of dict object at 0x7e6108405240> Operating System
schneider-electric epas_gtw_firmware 6.4 <built-in method update of dict object at 0x7e6111c1d880> Operating System
schneider-electric epas_gtw_firmware 6.4 <built-in method update of dict object at 0x7e60bafada40> Operating System
schneider-electric saitel_dr_firmware * <built-in method update of dict object at 0x7e6111c1c380> Operating System
schneider-electric scd2200_firmware * <built-in method update of dict object at 0x7e60a8897540> Operating System
rockwellautomation aadvance_controller * <built-in method update of dict object at 0x7e60bacd5100> Application
rockwellautomation isagraf_free_runtime * <built-in method update of dict object at 0x7e60bacd5500> Application
rockwellautomation micro810_firmware - <built-in method update of dict object at 0x7e6112393240> Operating System
rockwellautomation micro820_firmware - <built-in method update of dict object at 0x7e6112392800> Operating System
rockwellautomation micro830_firmware - <built-in method update of dict object at 0x7e6108406580> Operating System
rockwellautomation micro850_firmware - <built-in method update of dict object at 0x7e60bacd5e40> Operating System
rockwellautomation micro870_firmware - <built-in method update of dict object at 0x7e60bae4bc40> Operating System
xylem multismart_firmware * <built-in method update of dict object at 0x7e6134108a40> Operating System
rockwellautomation isagraf_runtime * <built-in method update of dict object at 0x7e6111c1c040> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*
Yes cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*
Yes cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*
No cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:windows:*:*
Notification
Message here