NetSight
IP …
medium6.7

CVE-2020-25182

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries.

Impact

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft Windows systems.

Affected products

VendorProductAffected versions
Schneider-ElectricEasergy T300 Firmware
through 2.7.1
Schneider-ElectricEasergy C5 Firmware
before 1.1.0
Schneider-ElectricMicom C264 Firmware
before d6.1
Schneider-ElectricPacis Gtw Firmware
Versions 5.1, 5.2, 6.1, 6.3
Schneider-ElectricSaitel Dp Firmware
through 11.06.21
Schneider-ElectricEpas Gtw Firmware
Version 6.4
Schneider-ElectricSaitel Dr Firmware
through 11.06.12
Schneider-ElectricScd2200 Firmware
through 10024
RockwellautomationAadvance Controller
through 1.40
RockwellautomationIsagraf Free Runtime
through 6.6.8
RockwellautomationMicro810 Firmware
All versions
RockwellautomationMicro820 Firmware
All versions

Weakness classification

CWE-427

References