Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal
Priority MEDIUM 52CWE-23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.06421 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rockwell | ISaGRAF Runtime | 4.x; 5.x | — | No fix listed | CNA |
- ISaGRAF Runtime VendorRockwell Affected 4.x; 5.x Fixed in — No fix listed CNA
CPE configurations NVD · 36
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:* | up to 2.7.1 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:* | before 1.1.0 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:* | before d6.1 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:* | 5.1 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:* | 5.2 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:* | 6.1 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:* | 6.3 | Vulnerable | Schneider Electric |
- cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:* Versions up to 2.7.1 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:* Versions before d6.1 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:* Versions 5.1 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:* Versions 5.2 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:* Versions 6.1 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:* Versions 6.3 Vulnerable ·Schneider Electric
Show 26 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:* | 6.3 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:* | up to 11.06.21 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:* | 6.4 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:* | 6.4 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:* | up to 11.06.12 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:* | up to 10024 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:* | up to 1.40 | Vulnerable | Rockwell |
| cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:* | up to 6.6.8 | Vulnerable | Rockwell |
| cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:* | 5.0 to before 6.0 | Vulnerable | Rockwell |
| cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:* | before 3.2.0 | Vulnerable | Xylem |
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:* Versions 6.3 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:* Versions up to 11.06.21 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:* Versions 6.4 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:* Versions 6.4 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:* Versions up to 11.06.12 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:* Versions up to 10024 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:* Versions up to 1.40 Vulnerable ·Rockwell
- cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:* Versions up to 6.6.8 Vulnerable ·Rockwell
- cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:* Versions 5.0 to before 6.0 Vulnerable ·Rockwell
- cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:* Versions before 3.2.0 Vulnerable ·Xylem
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25176
- 2026-10-03 Alias added: GHSA-fg53-m5qv-8qwq
References
Advisory 3
More Rockwell Aadvance Controller vulnerabilities
- TI-2020-15420 Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Information CVSS 3.1HIGH 8.8
- TI-2020-15426 Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials CVSS 3.1HIGH 7.8
- TI-2020-15424 Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element CVSS 3.1MEDIUM 6.7
- TI-2020-15422 Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key CVSS 3.1MEDIUM 6.5
Sources
- CVE-2020-25176 · CVE Program
- CVE-2020-25176 · NVD
- FIRST EPSS
- GHSA-fg53-m5qv-8qwq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences