Rockwell Automation ISaGRAF5 Runtime (Update A)

🗓️ 06 Oct 2020 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 127 Views

Rockwell Automation ISaGRAF5 Runtime (Update A) advisory with CVSS v3 9.1, affecting all ISaGRAF Runtime Versions 4.x and 5.x, may lead to remote code execution, information disclosure, and denial-of-service. Vulnerabilities include Use of Hard-coded Cryptographic Key, Unprotected Storage of Credentials, Relative Path Traversal, and Cleartext Transmission of Sensitive Information

Reporter	Title	Published	Views	Family All 66
BDU FSTEC	The vulnerability of the application development environment for ISaGRAF programmable logic controllers allows a hacker to disclose protected information.	22 May 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the application development environment for ISaGRAF programmable logic controllers arises from the use of an unreliable search path during the loading of dynamic libraries. This allows a hacker to execute arbitrary code.	28 Jun 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the application development environment for ISaGRAF programmable logic controllers allows attackers to access password information stored in an unencrypted form, thereby enabling them to compromise the protected data.	4 Jul 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the TCP/IP communication protocol implementation in the development environment for programmable logic controllers ISaGRAF Workbench allows a attacker to upload, read, and delete files.	4 Jul 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the eXchange Layer component in the application development environment for programmable logic controllers ISaGRAF Runtime Rockwell Automation allows a hacker to execute arbitrary code.	6 Jul 202300:00	–	bdu_fstec
Circl	CVE-2020-25176	10 Mar 202604:00	–	circl
Circl	CVE-2020-25178	10 Mar 202604:00	–	circl
Circl	CVE-2020-25180	10 Mar 202604:00	–	circl
Circl	CVE-2020-25182	18 Mar 202221:33	–	circl
Circl	CVE-2020-25184	10 Mar 202604:00	–	circl

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-280-01.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-20-280-01
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
us-cert	www.us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B
us-cert	www.us-cert.cisa.gov/ncas/tips/ST04-014

06 Oct 2020 00:00Current

8.3High risk

Vulners AI Score8.3

CVSS 29.3

CVSS 3.19.1 - 9.8

EPSS0.03509

SSVC