Lucene search

K
cve[email protected]CVE-2020-25184
HistoryMar 18, 2022 - 6:15 p.m.

CVE-2020-25184

2022-03-1818:15:09
CWE-522
CWE-256
web.nvd.nist.gov
27
cve-2020-25184
rockwell automation
isagraf runtime
plaintext passwords
information disclosure
nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

5.3 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

15.6%

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.

Affected configurations

NVD
Node
schneider-electriceasergy_t300_firmwareRange≀2.7.1
AND
schneider-electriceasergy_t300Match-
Node
schneider-electriceasergy_c5_firmwareRange<1.1.0
AND
schneider-electriceasergy_c5Match-
Node
schneider-electricmicom_c264_firmwareRange<d6.1
AND
schneider-electricmicom_c264Match-
Node
schneider-electricpacis_gtw_firmwareMatch5.1windows
OR
schneider-electricpacis_gtw_firmwareMatch5.2windows
OR
schneider-electricpacis_gtw_firmwareMatch6.1windows
OR
schneider-electricpacis_gtw_firmwareMatch6.3linux
OR
schneider-electricpacis_gtw_firmwareMatch6.3windows
AND
schneider-electricpacis_gtwMatch-
Node
schneider-electricsaitel_dp_firmwareRange≀11.06.21
AND
schneider-electricsaitel_dpMatch-
Node
schneider-electricepas_gtw_firmwareMatch6.4linux
OR
schneider-electricepas_gtw_firmwareMatch6.4windows
AND
schneider-electricepas_gtwMatch-
Node
schneider-electricsaitel_dr_firmwareRange≀11.06.12
AND
schneider-electricsaitel_drMatch-
Node
schneider-electricscd2200_firmwareRange≀10024
AND
schneider-electriccp-3Match-
OR
schneider-electricmc-31Match-
Node
rockwellautomationaadvance_controllerRange≀1.40
OR
rockwellautomationisagraf_free_runtimeRange≀6.6.8isagraf6_workbench
OR
rockwellautomationisagraf_runtimeRange5.0–6.0
Node
rockwellautomationmicro810_firmwareMatch-
AND
rockwellautomationmicro810Match-
Node
rockwellautomationmicro820_firmwareMatch-
AND
rockwellautomationmicro820Match-
Node
rockwellautomationmicro830Match-
AND
rockwellautomationmicro830_firmwareMatch-
Node
rockwellautomationmicro850Match-
AND
rockwellautomationmicro850_firmwareMatch-
Node
rockwellautomationmicro870Match-
AND
rockwellautomationmicro870_firmwareMatch-
Node
xylemmultismart_firmwareRange<3.2.0

CNA Affected

[
  {
    "product": "ISaGRAF Runtime",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "status": "affected",
        "version": "4.x"
      },
      {
        "status": "affected",
        "version": "5.x"
      }
    ]
  }
]

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

5.3 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

15.6%

Related for CVE-2020-25184