CVE-2020-25184 HIGH

Published: 2022-03-18 | Last Modified: 2024-11-21 | Status: Modified

Description

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.

Additional Descriptions (1)

Rockwell Automation ISaGRAF Runtime Versiones 4.x y 5.x, almacena la contraseña en texto plano en un archivo que está en el mismo directorio que el archivo ejecutable. ISaGRAF Runtime lee el archivo y guarda los datos en una variable sin ninguna modificación adicional. Un atacante local, no autenticado, podría comprometer las contraseñas de los usuarios, resultando en una divulgación de información

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector	LOCAL
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Base Score: 2.1 (LOW)

AV:L/AC:L/Au:N/C:P/I:N/A:N

Access Vector	LOCAL
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-256
[email protected]	Primary	en CWE-522

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	easergy_t300_firmware	*	<built-in method update of dict object at 0x7e6108502f80>	Operating System
schneider-electric	easergy_c5_firmware	*	<built-in method update of dict object at 0x7e6108502bc0>	Operating System
schneider-electric	micom_c264_firmware	*	<built-in method update of dict object at 0x7e6107bca640>	Operating System
schneider-electric	pacis_gtw_firmware	5.1	<built-in method update of dict object at 0x7e610841e140>	Operating System
schneider-electric	pacis_gtw_firmware	5.2	<built-in method update of dict object at 0x7e60baa08900>	Operating System
schneider-electric	pacis_gtw_firmware	6.1	<built-in method update of dict object at 0x7e60baa09bc0>	Operating System
schneider-electric	pacis_gtw_firmware	6.3	<built-in method update of dict object at 0x7e60a8793880>	Operating System
schneider-electric	pacis_gtw_firmware	6.3	<built-in method update of dict object at 0x7e6111e19800>	Operating System
schneider-electric	saitel_dp_firmware	*	<built-in method update of dict object at 0x7e613c334700>	Operating System
schneider-electric	epas_gtw_firmware	6.4	<built-in method update of dict object at 0x7e60baa088c0>	Operating System
schneider-electric	epas_gtw_firmware	6.4	<built-in method update of dict object at 0x7e60baa09900>	Operating System
schneider-electric	saitel_dr_firmware	*	<built-in method update of dict object at 0x7e610841ef00>	Operating System
schneider-electric	scd2200_firmware	*	<built-in method update of dict object at 0x7e610841f500>	Operating System
rockwellautomation	aadvance_controller	*	<built-in method update of dict object at 0x7e60baa09a80>	Application
rockwellautomation	isagraf_free_runtime	*	<built-in method update of dict object at 0x7e60baa29dc0>	Application
rockwellautomation	isagraf_runtime	*	<built-in method update of dict object at 0x7e60bae0e480>	Application
rockwellautomation	micro810_firmware	-	<built-in method update of dict object at 0x7e6108502f00>	Operating System
rockwellautomation	micro820_firmware	-	<built-in method update of dict object at 0x7e6107bcbdc0>	Operating System
rockwellautomation	micro830_firmware	-	<built-in method update of dict object at 0x7e610841f600>	Operating System
rockwellautomation	micro850_firmware	-	<built-in method update of dict object at 0x7e60a8790780>	Operating System
rockwellautomation	micro870_firmware	-	<built-in method update of dict object at 0x7e6108503cc0>	Operating System
xylem	multismart_firmware	*	<built-in method update of dict object at 0x7e6108503c80>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:easergy_t300_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:easergy_t300:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:easergy_c5_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:easergy_c5:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:micom_c264_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:micom_c264:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:::::windows::`
Yes	`cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:::::windows::`
Yes	`cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:::::windows::`
Yes	`cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:::::linux::`
Yes	`cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:::::windows::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:pacis_gtw:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:saitel_dp_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:saitel_dp:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:::::linux::`
Yes	`cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:::::windows::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:epas_gtw:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:saitel_dr_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:saitel_dr:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:scd2200_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:cp-3:-:::::::*`
No	`cpe:2.3:h:schneider-electric:mc-31:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:rockwellautomation:aadvance_controller::::::::`
Yes	`cpe:2.3:a:rockwellautomation:isagraf_free_runtime::::::isagraf6_workbench::*`
Yes	`cpe:2.3:a:rockwellautomation:isagraf_runtime::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:rockwellautomation:micro810_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:rockwellautomation:micro810:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:rockwellautomation:micro820_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:rockwellautomation:micro820:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:rockwellautomation:micro830_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:rockwellautomation:micro830:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:rockwellautomation:micro850_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:rockwellautomation:micro850:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:rockwellautomation:micro870_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:rockwellautomation:micro870:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:xylem:multismart_firmware::::::::`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
Source: [email protected]

Vendor Advisory
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
Source: [email protected]

Permissions Required
https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
Source: [email protected]

Third Party Advisory US Government Resource
https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
Source: [email protected]

Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required
https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory US Government Resource
https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory