NetSight
IP …
high7.5

CVE-2020-25178

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP.

Impact

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files.

Affected products

VendorProductAffected versions
Schneider-ElectricEasergy T300 Firmware
through 2.7.1
Schneider-ElectricEasergy C5 Firmware
before 1.1.0
Schneider-ElectricMicom C264 Firmware
before d6.1
Schneider-ElectricPacis Gtw Firmware
Versions 5.1, 5.2, 6.1, 6.3
Schneider-ElectricSaitel Dp Firmware
through 11.06.21
Schneider-ElectricEpas Gtw Firmware
Version 6.4
Schneider-ElectricSaitel Dr Firmware
through 11.06.12
Schneider-ElectricScd2200 Firmware
through 10024
RockwellautomationAadvance Controller
through 1.40
RockwellautomationIsagraf Free Runtime
through 6.6.8
RockwellautomationIsagraf Runtime
from 5.0 before 6.0
RockwellautomationMicro810 Firmware
All versions

Weakness classification

CWE-319

References