CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NCVE-2020-25180
Medium (6.5). EPSS 1.2% chance of exploitation in the next 30 days.
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-798, CWE-321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rockwellautomation:aadvance_controller
- rockwellautomation:isagraf_free_runtime
- rockwellautomation:isagraf_runtime
- rockwellautomation:micro810_firmware
- rockwellautomation:micro820_firmware
- rockwellautomation:micro830_firmware
- rockwellautomation:micro850_firmware
- rockwellautomation:micro870_firmware
- schneider-electric:easergy_c5_firmware
- schneider-electric:easergy_t300_firmware
- schneider-electric:epas_gtw_firmware
- schneider-electric:micom_c264_firmware
- schneider-electric:pacis_gtw_firmware
- schneider-electric:saitel_dp_firmware
- schneider-electric:saitel_dr_firmware
- schneider-electric:scd2200_firmware
- xylem:multismart_firmware
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
- https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
- https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04