Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Information
Priority MEDIUM 43CWE-319Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.
Summary
ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01691 77th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rockwell | ISaGRAF Runtime | 4.x; 5.x | — | No fix listed | CNA |
- ISaGRAF Runtime VendorRockwell Affected 4.x; 5.x Fixed in — No fix listed CNA
CPE configurations NVD · 36
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:* | up to 2.7.1 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:* | before 1.1.0 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:* | before d6.1 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:* | 5.1 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:* | 5.2 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:* | 6.1 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:* | 6.3 | Vulnerable | Schneider Electric |
- cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:* Versions up to 2.7.1 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:* Versions before d6.1 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:* Versions 5.1 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:* Versions 5.2 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:* Versions 6.1 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:* Versions 6.3 Vulnerable ·Schneider Electric
Show 26 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:* | 6.3 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:* | up to 11.06.21 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:* | 6.4 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:* | 6.4 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:* | up to 11.06.12 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:* | up to 10024 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:* | up to 1.40 | Vulnerable | Rockwell |
| cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:* | up to 6.6.8 | Vulnerable | Rockwell |
| cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:* | 5.0 to before 6.0 | Vulnerable | Rockwell |
| cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:* | before 3.2.0 | Vulnerable | Xylem |
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:* Versions 6.3 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:* Versions up to 11.06.21 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:* Versions 6.4 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:* Versions 6.4 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:* Versions up to 11.06.12 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:* Versions up to 10024 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:* Versions up to 1.40 Vulnerable ·Rockwell
- cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:* Versions up to 6.6.8 Vulnerable ·Rockwell
- cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:* Versions 5.0 to before 6.0 Vulnerable ·Rockwell
- cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:* Versions before 3.2.0 Vulnerable ·Xylem
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25178
- 2026-10-03 Alias added: GHSA-9x5p-r7c6-hf92
References
Advisory 3
More Rockwell Aadvance Controller vulnerabilities
- TI-2020-15418 Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal CVSS 3.1CRITICAL 9.8
- TI-2020-15426 Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials CVSS 3.1HIGH 7.8
- TI-2020-15424 Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element CVSS 3.1MEDIUM 6.7
- TI-2020-15422 Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key CVSS 3.1MEDIUM 6.5
Sources
- CVE-2020-25178 · CVE Program
- CVE-2020-25178 · NVD
- FIRST EPSS
- GHSA-9x5p-r7c6-hf92 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences