NetSight
IP …
critical9.1

CVE-2020-25176

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file sy…

Impact

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.

Affected products

VendorProductAffected versions
Schneider-ElectricEasergy T300 Firmware
through 2.7.1
Schneider-ElectricEasergy C5 Firmware
before 1.1.0
Schneider-ElectricMicom C264 Firmware
before d6.1
Schneider-ElectricPacis Gtw Firmware
Versions 5.1, 5.2, 6.1, 6.3
Schneider-ElectricSaitel Dp Firmware
through 11.06.21
Schneider-ElectricEpas Gtw Firmware
Version 6.4
Schneider-ElectricSaitel Dr Firmware
through 11.06.12
Schneider-ElectricScd2200 Firmware
through 10024
RockwellautomationAadvance Controller
through 1.40
RockwellautomationIsagraf Free Runtime
through 6.6.8
RockwellautomationIsagraf Runtime
from 5.0 before 6.0
RockwellautomationMicro810 Firmware
All versions

Weakness classification

CWE-23CWE-22

References