by Kastro
Paper/Archive/CVE-2020-25176

CVE-2020-25176

Rockwell Automation ISaGRAF Runtime — Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal

EPSS 6%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 93.7.937 × 2018.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.

Affected

ProductAffectedFixed inSource
ISaGRAF Runtime4.x–CNA
ISaGRAF Runtime5.x–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-20-280-01refrockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699refdownload.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04refxylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf