CVE-2020-25180

Summary (CVE-2020-25180) Rockwell Automation ISaGRAF Runtime 4.x–5.x uses a fixed-key TEA-based encryption for passwords needed to run privileged commands. A remote, unauthenticated attacker can submit a self-encrypted password to ISaGRAF 5 Runtime, potentially causing information disclosure on t...

CVE-2020-25184 Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could...

CVE-2020-25184

CVE-2020-25184 affects Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x, where passwords are stored in plaintext in a file located in the same directory as the executable. ISaGRAF Runtime reads this file and stores the data in a variable without modification, enabling a local, unauthentic...

CVE-2020-25184 Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could...

CVE-2020-25176

CVE-2020-25176 affects Rockwell Automation ISaGRAF Runtime (IXL) 4.x–5.x. The vulnerability arises because the filename parameter is not checked for reserved characters, enabling a remote, unauthenticated attacker to traverse directories and potentially achieve remote code execution. Affected com...

CVE-2020-25176 Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer IXL protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated...

CVE-2020-25178 Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Information

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote...

CVE-2020-25178

ISaGRAF CVE-2020-25178 affects Rockwell Automation ISaGRAF Runtime 4.x/5.x when interfaced with ISaGRAF Workbench over TCP/IP. The protocol transmits data unencrypted, enabling a remote unauthenticated attacker to upload, read, and delete files. Affected product details and mitigations are suppor...

CVE-2020-25182 Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft...

CVE-2020-25182

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x on Windows are affected by CVE-2020-25182 due to Uncontrolled loading of dynamic libraries (DLL search path). This local, unauthenticated vulnerability could allow an attacker to execute arbitrary code by manipulating the dynamic library lo...

PT-2021-7832 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: Rockwell Automation ISaGRAF Runtime versions 4.x through 5.x Description: The issue is related to the uncontrolled loading of dynamic libraries by Rockwell Automation ISaGRAF Runtime, which could allow a local, unauthenticated attacker to...

Rockwell Automation ISaGRAF 安全漏洞

Rockwell Automation ISaGRAF is an automation software technology for creating integrated automation solutions from Rockwell Automation. It is designed to be scalable and portable and is suitable for developing small controllers and large distributed automation systems. A security vulnerability...

Rockwell Automation ISaGRAF 信任管理问题漏洞

Rockwell Automation ISaGRAF is an automation software technology for creating integrated automation solutions from Rockwell Automation. It is designed to be scalable and portable and is suitable for developing small controllers and large distributed automation systems. Rockwell Automation ISaGRAF...

PT-2021-7837 · Rockwell Automation · Isagraf Runtime

Name of the Vulnerable Software and Affected Versions: Rockwell Automation ISaGRAF Runtime versions 4.x through 5.x Description: The issue concerns the storage of passwords in plaintext within a file located in the same directory as the executable file. This file is read by ISaGRAF Runtime, and t...

Rockwell Automation ISaGRAF 安全漏洞

Rockwell Automation ISaGRAF is an automation software technology for creating integrated automation solutions from Rockwell Automation. It is designed to be scalable and portable and is suitable for developing small controllers and large distributed automation systems. A security vulnerability...

Rockwell Automation ISaGRAF 路径遍历漏洞

Rockwell Automation ISaGRAF is an automation software technology for creating integrated automation solutions from Rockwell Automation. It is designed to be scalable and portable and is suitable for developing small controllers and large distributed automation systems. A security vulnerability...

PT-2021-7842 · Rockwell Automation · Isagraf Runtime

Name of the Vulnerable Software and Affected Versions: Rockwell Automation ISaGRAF Runtime versions 4.x through 5.x Description: The issue is related to errors in handling relative paths to directories with limited access in the eXchange Layer IXL component of the Rockwell Automation ISaGRAF...

Rockwell Automation ISaGRAF5 Runtime (Update A)

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ISaGRAF5 Runtime Vulnerabilities: Use of Hard-coded Cryptographic Key, Unprotected Storage of Credentials, Relative Path Traversal, Uncontrolled Search Path Element,...