Vulnerabilities

TI-2020-15422 CVE-2020-25180 · GHSA-rq23-5rjf-c828

Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key

LOW 31

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01163 Published 2022-03-18 No fix listed CWE-321

TI-2020-15426 CVE-2020-25184 · GHSA-3f6m-7jq2-3x7m

Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials

LOW 36

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00437 Published 2022-03-18 No fix listed CWE-256

TI-2020-15418 CVE-2020-25176 · GHSA-fg53-m5qv-8qwq

Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal

MEDIUM 52

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06421 Published 2022-03-18 No fix listed CWE-23

TI-2020-15424 CVE-2020-25182 · GHSA-f6jg-3f64-ghp3

Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element

LOW 32

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00446 Published 2022-03-18 No fix listed CWE-427

TI-2020-15420 CVE-2020-25178 · GHSA-9x5p-r7c6-hf92

Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Information

MEDIUM 43

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01691 Published 2022-03-18 No fix listed CWE-319