CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2020-25178
High (8.8). EPSS 1.7% chance of exploitation in the next 30 days.
ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files.
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
- CWE
- CWE-319
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rockwellautomation:aadvance_controller
- rockwellautomation:isagraf_free_runtime
- rockwellautomation:isagraf_runtime
- rockwellautomation:micro810_firmware
- rockwellautomation:micro820_firmware
- rockwellautomation:micro830_firmware
- rockwellautomation:micro850_firmware
- rockwellautomation:micro870_firmware
- schneider-electric:easergy_c5_firmware
- schneider-electric:easergy_t300_firmware
- schneider-electric:epas_gtw_firmware
- schneider-electric:micom_c264_firmware
- schneider-electric:pacis_gtw_firmware
- schneider-electric:saitel_dp_firmware
- schneider-electric:saitel_dr_firmware
- schneider-electric:scd2200_firmware
- xylem:multismart_firmware
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
- https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
- https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04