CVSS 3.1
6.7 mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVE-2020-25182
Medium (6.7). EPSS 0.4% chance of exploitation in the next 30 days.
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft Windows systems.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWE
- CWE-427
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rockwellautomation:aadvance_controller
- rockwellautomation:isagraf_free_runtime
- rockwellautomation:isagraf_runtime
- rockwellautomation:micro810_firmware
- rockwellautomation:micro820_firmware
- rockwellautomation:micro830_firmware
- rockwellautomation:micro850_firmware
- rockwellautomation:micro870_firmware
- schneider-electric:easergy_c5_firmware
- schneider-electric:easergy_t300_firmware
- schneider-electric:epas_gtw_firmware
- schneider-electric:micom_c264_firmware
- schneider-electric:pacis_gtw_firmware
- schneider-electric:saitel_dp_firmware
- schneider-electric:saitel_dr_firmware
- schneider-electric:scd2200_firmware
- xylem:multismart_firmware
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
- https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
- https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04