{"containers": {"cna": {"affected": [{"product": "ISaGRAF Runtime", "vendor": "Rockwell Automation", "versions": [{"status": "affected", "version": "4.x"}, {"status": "affected", "version": "5.x"}]}], "credits": [{"lang": "en", "value": "Kaspersky reported these vulnerabilities to Rockwell Automation."}], "descriptions": [{"lang": "en", "value": "Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-321", "description": "CWE-321 Use of Hard-coded Cryptographic Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-03-18T18:00:33", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"}], "solutions": [{"lang": "en", "value": "Rockwell Automation recommends users update to ISaGRAF Runtime 5 Version 5.72.00. End users are encouraged to restrict or block access on TCP 1131 and TCP 1132 from outside the industrial control system. Confirm the least-privilege user principle is followed and user/service account access to Runtime's folder location is granted with a minimum amount of rights needed.\n\nRockwell Automation recommends users of affected versions evaluate the mitigations provided and apply the appropriate mitigations to deployed products. Users are encouraged to combine this guidance with the general security guidelines for a comprehensive defense-in-depth strategy.\n\nTo reduce risk, Rockwell Automation recommends users:\n Employ proper network segmentation and security controls.\n Minimize network exposure for all control system devices.\n Locate control systems behind firewalls.\n Isolate control systems from other networks when possible.\n Refer to the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide for best practices deploying network segmentation and broader defense-in-depth strategies.\n Consider using proper network infrastructure controls, such as firewalls, UTM devices, VPN, or other security appliances.\n Ensure the least-privilege user principle is followed, and user/service account access to Runtime\u2019s folder location is granted with a minimum amount of rights, as needed.\n\nPlease see publications from Rockwell Automation and Schneider Electric, Xylem, or contact GE for further information about how to mitigate these vulnerabilities in additional affected products."}], "source": {"discovery": "EXTERNAL"}, "title": "Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2020-25180", "STATE": "PUBLIC", "TITLE": "Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ISaGRAF Runtime", "version": {"version_data": [{"version_affected": "=", "version_value": "4.x"}, {"version_affected": "=", "version_value": "5.x"}]}}]}, "vendor_name": "Rockwell Automation"}]}}, "credit": [{"lang": "eng", "value": "Kaspersky reported these vulnerabilities to Rockwell Automation."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-321 Use of Hard-coded Cryptographic Key"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01", "refsource": "CONFIRM", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"}, {"name": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699", "refsource": "CONFIRM", "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"}, {"name": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04", "refsource": "CONFIRM", "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04"}, {"name": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf", "refsource": "CONFIRM", "url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"}]}, "solution": [{"lang": "en", "value": "Rockwell Automation recommends users update to ISaGRAF Runtime 5 Version 5.72.00. End users are encouraged to restrict or block access on TCP 1131 and TCP 1132 from outside the industrial control system. Confirm the least-privilege user principle is followed and user/service account access to Runtime's folder location is granted with a minimum amount of rights needed.\n\nRockwell Automation recommends users of affected versions evaluate the mitigations provided and apply the appropriate mitigations to deployed products. Users are encouraged to combine this guidance with the general security guidelines for a comprehensive defense-in-depth strategy.\n\nTo reduce risk, Rockwell Automation recommends users:\n Employ proper network segmentation and security controls.\n Minimize network exposure for all control system devices.\n Locate control systems behind firewalls.\n Isolate control systems from other networks when possible.\n Refer to the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide for best practices deploying network segmentation and broader defense-in-depth strategies.\n Consider using proper network infrastructure controls, such as firewalls, UTM devices, VPN, or other security appliances.\n Ensure the least-privilege user principle is followed, and user/service account access to Runtime\u2019s folder location is granted with a minimum amount of rights, as needed.\n\nPlease see publications from Rockwell Automation and Schneider Electric, Xylem, or contact GE for further information about how to mitigate these vulnerabilities in additional affected products."}], "source": {"discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2020-25180", "datePublished": "2022-03-18T18:00:33", "dateReserved": "2020-09-04T00:00:00", "dateUpdated": "2022-03-18T18:00:33", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E07AFED6-47CC-4A19-80DB-C537F4F07736", "versionEndIncluding": "2.7.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*", "matchCriteriaId": "45E6C3FA-001D-449A-A512-327FA0C9AC5A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "01E1BC45-FFB3-4D5A-BA09-BA56A492E784", "versionEndExcluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2EF5114-E9EB-47E1-A388-0963337906C6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "17A5F6A2-32F6-4CDA-B2FE-EAA86B6BC43F", "versionEndExcluding": "d6.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*", "matchCriteriaId": "A4F6A5C4-E0B2-44F2-823F-9E9C59E7B1F5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*", "matchCriteriaId": "716B1453-6203-4E7C-947D-71A031F79B3E", "vulnerable": true}, {"criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*", "matchCriteriaId": "05986825-76CD-486D-941A-E69A084F2A3E", "vulnerable": true}, {"criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*", "matchCriteriaId": "F59F968F-E480-4262-9754-BBC180E1AE24", "vulnerable": true}, {"criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*", "matchCriteriaId": "514C1283-E965-4543-991B-24FD5AA07D58", "vulnerable": true}, {"criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*", "matchCriteriaId": "E3FDEC1C-930B-4B8D-A67A-1D46E2069A9B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*", "matchCriteriaId": "2240540D-73BB-47F1-A8CA-844DC6B00CE6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC5965EE-EB40-443A-BFDE-E97BD1C0F4E3", "versionEndIncluding": "11.06.21", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*", "matchCriteriaId": "E6D73382-1957-4CC7-953F-D57C005D63B0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*", "matchCriteriaId": "6011641C-4319-4FC3-9EB4-F8537A2C50C9", "vulnerable": true}, {"criteria": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*", "matchCriteriaId": "A08C5894-6894-44B7-809C-542732BDE84B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*", "matchCriteriaId": "4034AC56-BEC6-49EA-9C42-6D0AE360B7E1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "47A24A85-B912-4A15-AB2E-BF2EE739686F", "versionEndIncluding": "11.06.12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*", "matchCriteriaId": "E65C2AD5-0079-47AA-82F3-F9335DCFA0AA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D556CAB-DA72-4978-BB45-5B2834C03061", "versionEndIncluding": "10024", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*", "matchCriteriaId": "7C543522-AD89-48DD-90BB-47D686E93ADF", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*", "matchCriteriaId": "53C778F7-64DA-4FD4-BB7F-2E5BB8BDB774", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "81F6F3FE-B508-4482-B832-992242F80D30", "versionEndIncluding": "1.40", "vulnerable": true}, {"criteria": "cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*", "matchCriteriaId": "6B1C6230-85E9-4053-90EB-715919960F80", "versionEndIncluding": "6.6.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B3B8CEE-D6C8-44D9-B601-F862185A6075", "versionEndExcluding": "6.0", "versionStartIncluding": "5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "5798DD01-C49B-4DA9-9E83-2C875A345A1A", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*", "matchCriteriaId": "7CBC81B7-2559-46EB-A129-0456442C06D9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9FCA425-ACD4-4F6F-97CF-3B05A1C003E8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*", "matchCriteriaId": "7635A8EC-2D15-4BC6-938C-DC30AA21BEAB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "9BFBB963-DD14-405D-B9ED-6277354A5A57", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*", "matchCriteriaId": "8EE48F31-B3FE-463F-B366-05116E4093DE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "8EEDFAA2-4E38-457E-9E50-802984D1C0E6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*", "matchCriteriaId": "B8BD0226-7434-4849-AD0D-35AB5A793F25", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "CAFD020B-28D9-4EC5-A282-4D42DC02A34C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*", "matchCriteriaId": "09DEF107-D1C4-456A-BB02-1731498568FD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F64B0A94-A252-4052-A2C2-CD2374E3CCF2", "versionEndExcluding": "3.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device."}, {"lang": "es", "value": "Rockwell Automation ISaGRAF Runtime versiones 4.x y 5.x, incluyen la funcionalidad setting a password que es requerida para ejecutar comandos privilegiados. El valor de la contrase\u00f1a que es pasada a ISaGRAF Runtime es el resultado de la encriptaci\u00f3n llevada a cabo con un valor de clave fijo usando el algoritmo de encriptaci\u00f3n diminuto (TEA) en una contrase\u00f1a introducida o guardada. Un atacante remoto, no autenticado, podr\u00eda pasar su propia contrase\u00f1a encriptada al ISaGRAF 5 Runtime, lo que podr\u00eda resultar en una divulgaci\u00f3n de informaci\u00f3n en el dispositivo"}], "id": "CVE-2020-25180", "lastModified": "2022-04-04T20:59:49.830", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2022-03-18T18:15:09.187", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Vendor Advisory"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Permissions Required"], "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory"], "url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-321"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}