CVE-2020-25176

CVE-2020-25176 affects Rockwell Automation ISaGRAF Runtime (IXL) 4.x–5.x. The vulnerability arises because the filename parameter is not checked for reserved characters, enabling a remote, unauthenticated attacker to traverse directories and potentially achieve remote code execution. Affected com...

CVE-2020-25180

Summary (CVE-2020-25180) Rockwell Automation ISaGRAF Runtime 4.x–5.x uses a fixed-key TEA-based encryption for passwords needed to run privileged commands. A remote, unauthenticated attacker can submit a self-encrypted password to ISaGRAF 5 Runtime, potentially causing information disclosure on t...

CVE-2020-25182

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x on Windows are affected by CVE-2020-25182 due to Uncontrolled loading of dynamic libraries (DLL search path). This local, unauthenticated vulnerability could allow an attacker to execute arbitrary code by manipulating the dynamic library lo...

CVE-2020-25184

CVE-2020-25184 affects Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x, where passwords are stored in plaintext in a file located in the same directory as the executable. ISaGRAF Runtime reads this file and stores the data in a variable without modification, enabling a local, unauthentic...

CVE-2020-25178

ISaGRAF CVE-2020-25178 affects Rockwell Automation ISaGRAF Runtime 4.x/5.x when interfaced with ISaGRAF Workbench over TCP/IP. The protocol transmits data unencrypted, enabling a remote unauthenticated attacker to upload, read, and delete files. Affected product details and mitigations are suppor...