CVE-2020-25176

high-risk

Published 2022-03-18

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.

Do I need to act?

3.5% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.1/10 Critical

NETWORK / LOW complexity

Affected Products (20)

Easergy T300 Firmware

Easergy C5 Firmware

Micom C264 Firmware

Pacis Gtw Firmware

Saitel Dp Firmware

Epas Gtw Firmware

Saitel Dr Firmware

Scd2200 Firmware

Aadvance Controller

Isagraf Free Runtime

Isagraf Runtime

Micro810 Firmware

Micro820 Firmware

Micro830 Firmware

Micro850 Firmware

Affected Vendors

Rockwellautomation Schneider-Electric Xylem

References (8)

Mitigation https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04

Permissions Required https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699

Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01

Third Party Advisory https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-mult...

Mitigation https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04

Permissions Required https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699

Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01

Third Party Advisory https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-mult...

/ 100

high-risk

Severity 31/34 · Critical

Exploitability 7/34 · Low

Exposure 20/34 · Moderate