Vulnerabilities

TI-2020-15422 CVE-2020-25180 · GHSA-rq23-5rjf-c828

Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key

LOW 31

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01163 Published 2022-03-18 No fix listed CWE-321

TI-2020-15426 CVE-2020-25184 · GHSA-3f6m-7jq2-3x7m

Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials

LOW 36

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00437 Published 2022-03-18 No fix listed CWE-256

TI-2020-15418 CVE-2020-25176 · GHSA-fg53-m5qv-8qwq

Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal

MEDIUM 52

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06421 Published 2022-03-18 No fix listed CWE-23

TI-2020-15424 CVE-2020-25182 · GHSA-f6jg-3f64-ghp3

Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element

LOW 32

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00446 Published 2022-03-18 No fix listed CWE-427

TI-2020-15420 CVE-2020-25178 · GHSA-9x5p-r7c6-hf92

Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Information

MEDIUM 43

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01691 Published 2022-03-18 No fix listed CWE-319

TI-2021-18998 CVE-2021-42833 · GHSA-3jx4-rw6p-82pp

Use of hardcoded credentials impacting AquaView versions 1.60, 7.x, 8.x

LOW 39

A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate users and system settings.

CVSS 3.1CRITICAL 9.3 Local No auth No interaction EPSS 0.00211 Published 2022-02-07 No fix listed CWE-798

TI-2021-17912 CVE-2021-41063 · GHSA-7532-2whq-rwqh

SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to…

MEDIUM 46

SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02111 Published 2021-12-08 No fix listed CWE-89