Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials
Priority LOW 36CWE-256Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-256.
Summary
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00437 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rockwell | ISaGRAF Runtime | 4.x; 5.x | — | No fix listed | CNA |
- ISaGRAF Runtime VendorRockwell Affected 4.x; 5.x Fixed in — No fix listed CNA
CPE configurations NVD · 36
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:* | up to 2.7.1 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:* | before 1.1.0 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:* | before d6.1 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:* | 5.1 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:* | 5.2 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:* | 6.1 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:* | 6.3 | Vulnerable | Schneider Electric |
- cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:* Versions up to 2.7.1 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:* Versions before d6.1 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:* Versions 5.1 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:* Versions 5.2 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:* Versions 6.1 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:* Versions 6.3 Vulnerable ·Schneider Electric
Show 26 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:* | 6.3 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:* | up to 11.06.21 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:* | 6.4 | Vulnerable | Schneider Electric |
| cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:* | 6.4 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:* | up to 11.06.12 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:* | up to 10024 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:* | up to 1.40 | Vulnerable | Rockwell |
| cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:* | up to 6.6.8 | Vulnerable | Rockwell |
| cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:* | 5.0 to before 6.0 | Vulnerable | Rockwell |
| cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:* | before 3.2.0 | Vulnerable | Xylem |
- cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:* Versions 6.3 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:* Versions up to 11.06.21 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:* Versions 6.4 Vulnerable ·Schneider Electric
- cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:* Versions 6.4 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:* Versions up to 11.06.12 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:* Versions up to 10024 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:* Versions up to 1.40 Vulnerable ·Rockwell
- cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:* Versions up to 6.6.8 Vulnerable ·Rockwell
- cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:* Versions 5.0 to before 6.0 Vulnerable ·Rockwell
- cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:* Versions before 3.2.0 Vulnerable ·Xylem
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25184
- 2026-10-03 Alias added: GHSA-3f6m-7jq2-3x7m
References
Advisory 3
More Rockwell Aadvance Controller vulnerabilities
- TI-2020-15418 Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal CVSS 3.1CRITICAL 9.8
- TI-2020-15420 Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Information CVSS 3.1HIGH 8.8
- TI-2020-15424 Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element CVSS 3.1MEDIUM 6.7
- TI-2020-15422 Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key CVSS 3.1MEDIUM 6.5
Sources
- CVE-2020-25184 · CVE Program
- CVE-2020-25184 · NVD
- FIRST EPSS
- GHSA-3f6m-7jq2-3x7m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences