CVSS 3.1
5.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2020-25184
Medium (5.5). EPSS 0.4% chance of exploitation in the next 30 days.
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-522, CWE-256
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rockwellautomation:aadvance_controller
- rockwellautomation:isagraf_free_runtime
- rockwellautomation:isagraf_runtime
- rockwellautomation:micro810_firmware
- rockwellautomation:micro820_firmware
- rockwellautomation:micro830_firmware
- rockwellautomation:micro850_firmware
- rockwellautomation:micro870_firmware
- schneider-electric:easergy_c5_firmware
- schneider-electric:easergy_t300_firmware
- schneider-electric:epas_gtw_firmware
- schneider-electric:micom_c264_firmware
- schneider-electric:pacis_gtw_firmware
- schneider-electric:saitel_dp_firmware
- schneider-electric:saitel_dr_firmware
- schneider-electric:scd2200_firmware
- xylem:multismart_firmware
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
- https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
- https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04