{"containers": {"cna": {"affected": [{"product": "ISaGRAF Runtime", "vendor": "Rockwell Automation", "versions": [{"status": "affected", "version": "4.x"}, {"status": "affected", "version": "5.x"}]}], "credits": [{"lang": "en", "value": "Kaspersky reported these vulnerabilities to Rockwell Automation."}], "descriptions": [{"lang": "en", "value": "Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application\u2019s directory, which could lead to remote code execution."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-23", "description": "CWE-23 Relative Path Traversal", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-03-18T18:00:31", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"}], "solutions": [{"lang": "en", "value": "Rockwell Automation recommends users update to ISaGRAF Runtime 5 Version 5.72.00. End users are encouraged to restrict or block access on TCP 1131 and TCP 1132 from outside the industrial control system. Confirm the least-privilege user principle is followed and user/service account access to Runtime's folder location is granted with a minimum amount of rights needed.\n\nRockwell Automation recommends users of affected versions evaluate the mitigations provided and apply the appropriate mitigations to deployed products. Users are encouraged to combine this guidance with the general security guidelines for a comprehensive defense-in-depth strategy.\n\nTo reduce risk, Rockwell Automation recommends users:\n Employ proper network segmentation and security controls.\n Minimize network exposure for all control system devices.\n Locate control systems behind firewalls.\n Isolate control systems from other networks when possible.\n Refer to the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide for best practices deploying network segmentation and broader defense-in-depth strategies.\n Consider using proper network infrastructure controls, such as firewalls, UTM devices, VPN, or other security appliances.\n Ensure the least-privilege user principle is followed, and user/service account access to Runtime\u2019s folder location is granted with a minimum amount of rights, as needed.\n\nPlease see publications from Rockwell Automation and Schneider Electric, Xylem, or contact GE for further information about how to mitigate these vulnerabilities in additional affected products."}], "source": {"discovery": "EXTERNAL"}, "title": "Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2020-25176", "STATE": "PUBLIC", "TITLE": "Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ISaGRAF Runtime", "version": {"version_data": [{"version_affected": "=", "version_value": "4.x"}, {"version_affected": "=", "version_value": "5.x"}]}}]}, "vendor_name": "Rockwell Automation"}]}}, "credit": [{"lang": "eng", "value": "Kaspersky reported these vulnerabilities to Rockwell Automation."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application\u2019s directory, which could lead to remote code execution."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-23 Relative Path Traversal"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01", "refsource": "CONFIRM", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"}, {"name": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699", "refsource": "CONFIRM", "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"}, {"name": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04", "refsource": "CONFIRM", "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04"}, {"name": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf", "refsource": "CONFIRM", "url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"}]}, "solution": [{"lang": "en", "value": "Rockwell Automation recommends users update to ISaGRAF Runtime 5 Version 5.72.00. End users are encouraged to restrict or block access on TCP 1131 and TCP 1132 from outside the industrial control system. Confirm the least-privilege user principle is followed and user/service account access to Runtime's folder location is granted with a minimum amount of rights needed.\n\nRockwell Automation recommends users of affected versions evaluate the mitigations provided and apply the appropriate mitigations to deployed products. Users are encouraged to combine this guidance with the general security guidelines for a comprehensive defense-in-depth strategy.\n\nTo reduce risk, Rockwell Automation recommends users:\n Employ proper network segmentation and security controls.\n Minimize network exposure for all control system devices.\n Locate control systems behind firewalls.\n Isolate control systems from other networks when possible.\n Refer to the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide for best practices deploying network segmentation and broader defense-in-depth strategies.\n Consider using proper network infrastructure controls, such as firewalls, UTM devices, VPN, or other security appliances.\n Ensure the least-privilege user principle is followed, and user/service account access to Runtime\u2019s folder location is granted with a minimum amount of rights, as needed.\n\nPlease see publications from Rockwell Automation and Schneider Electric, Xylem, or contact GE for further information about how to mitigate these vulnerabilities in additional affected products."}], "source": {"discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2020-25176", "datePublished": "2022-03-18T18:00:31", "dateReserved": "2020-09-04T00:00:00", "dateUpdated": "2022-03-18T18:00:31", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E07AFED6-47CC-4A19-80DB-C537F4F07736", "versionEndIncluding": "2.7.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*", "matchCriteriaId": "45E6C3FA-001D-449A-A512-327FA0C9AC5A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "01E1BC45-FFB3-4D5A-BA09-BA56A492E784", "versionEndExcluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2EF5114-E9EB-47E1-A388-0963337906C6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "17A5F6A2-32F6-4CDA-B2FE-EAA86B6BC43F", "versionEndExcluding": "d6.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*", "matchCriteriaId": "A4F6A5C4-E0B2-44F2-823F-9E9C59E7B1F5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*", "matchCriteriaId": "716B1453-6203-4E7C-947D-71A031F79B3E", "vulnerable": true}, {"criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*", "matchCriteriaId": "05986825-76CD-486D-941A-E69A084F2A3E", "vulnerable": true}, {"criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*", "matchCriteriaId": "F59F968F-E480-4262-9754-BBC180E1AE24", "vulnerable": true}, {"criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*", "matchCriteriaId": "514C1283-E965-4543-991B-24FD5AA07D58", "vulnerable": true}, {"criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*", "matchCriteriaId": "E3FDEC1C-930B-4B8D-A67A-1D46E2069A9B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*", "matchCriteriaId": "2240540D-73BB-47F1-A8CA-844DC6B00CE6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC5965EE-EB40-443A-BFDE-E97BD1C0F4E3", "versionEndIncluding": "11.06.21", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*", "matchCriteriaId": "E6D73382-1957-4CC7-953F-D57C005D63B0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*", "matchCriteriaId": "6011641C-4319-4FC3-9EB4-F8537A2C50C9", "vulnerable": true}, {"criteria": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*", "matchCriteriaId": "A08C5894-6894-44B7-809C-542732BDE84B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*", "matchCriteriaId": "4034AC56-BEC6-49EA-9C42-6D0AE360B7E1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "47A24A85-B912-4A15-AB2E-BF2EE739686F", "versionEndIncluding": "11.06.12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*", "matchCriteriaId": "E65C2AD5-0079-47AA-82F3-F9335DCFA0AA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D556CAB-DA72-4978-BB45-5B2834C03061", "versionEndIncluding": "10024", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*", "matchCriteriaId": "7C543522-AD89-48DD-90BB-47D686E93ADF", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*", "matchCriteriaId": "53C778F7-64DA-4FD4-BB7F-2E5BB8BDB774", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "81F6F3FE-B508-4482-B832-992242F80D30", "versionEndIncluding": "1.40", "vulnerable": true}, {"criteria": "cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*", "matchCriteriaId": "6B1C6230-85E9-4053-90EB-715919960F80", "versionEndIncluding": "6.6.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B3B8CEE-D6C8-44D9-B601-F862185A6075", "versionEndExcluding": "6.0", "versionStartIncluding": "5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "5798DD01-C49B-4DA9-9E83-2C875A345A1A", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*", "matchCriteriaId": "7CBC81B7-2559-46EB-A129-0456442C06D9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9FCA425-ACD4-4F6F-97CF-3B05A1C003E8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*", "matchCriteriaId": "7635A8EC-2D15-4BC6-938C-DC30AA21BEAB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "9BFBB963-DD14-405D-B9ED-6277354A5A57", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*", "matchCriteriaId": "8EE48F31-B3FE-463F-B366-05116E4093DE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "8EEDFAA2-4E38-457E-9E50-802984D1C0E6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*", "matchCriteriaId": "B8BD0226-7434-4849-AD0D-35AB5A793F25", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "CAFD020B-28D9-4EC5-A282-4D42DC02A34C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*", "matchCriteriaId": "09DEF107-D1C4-456A-BB02-1731498568FD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F64B0A94-A252-4052-A2C2-CD2374E3CCF2", "versionEndExcluding": "3.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application\u2019s directory, which could lead to remote code execution."}, {"lang": "es", "value": "Algunos comandos usados por el protocolo de Rockwell Automation ISaGRAF Runtime Versiones 4.x y 5.x eXchange Layer (IXL) llevan a cabo varias operaciones de archivo en el sistema de archivos. Dado que el par\u00e1metro que apunta al nombre del archivo no es comprobado en busca de caracteres reservados, es posible que un atacante remoto no autenticado recorra el directorio de una aplicaci\u00f3n, lo que podr\u00eda conllevar a una ejecuci\u00f3n remota de c\u00f3digo"}], "id": "CVE-2020-25176", "lastModified": "2022-04-04T20:56:17.697", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2022-03-18T18:15:09.060", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Permissions Required"], "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory"], "url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-23"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}