NetSight
IP …
high7.8

CVE-2020-25184

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file.

Impact

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.

Affected products

VendorProductAffected versions
Schneider-ElectricEasergy T300 Firmware
through 2.7.1
Schneider-ElectricEasergy C5 Firmware
before 1.1.0
Schneider-ElectricMicom C264 Firmware
before d6.1
Schneider-ElectricPacis Gtw Firmware
Versions 5.1, 5.2, 6.1, 6.3
Schneider-ElectricSaitel Dp Firmware
through 11.06.21
Schneider-ElectricEpas Gtw Firmware
Version 6.4
Schneider-ElectricSaitel Dr Firmware
through 11.06.12
Schneider-ElectricScd2200 Firmware
through 10024
RockwellautomationAadvance Controller
through 1.40
RockwellautomationIsagraf Free Runtime
through 6.6.8
RockwellautomationIsagraf Runtime
from 5.0 before 6.0
RockwellautomationMicro810 Firmware
All versions

Weakness classification

CWE-256CWE-522

References