FKIE_CVE-2020-25176

Vulnerability from fkie_nvd - Published: 2022-03-18 18:15 - Updated: 2024-11-21 05:17
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.
References
ics-cert@hq.dhs.govhttps://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04Mitigation, Vendor Advisory
ics-cert@hq.dhs.govhttps://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699Permissions Required
ics-cert@hq.dhs.govhttps://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01Third Party Advisory, US Government Resource
ics-cert@hq.dhs.govhttps://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdfThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699Permissions Required
af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdfThird Party Advisory
Impacted products
Vendor Product Version
schneider-electric easergy_t300_firmware *
schneider-electric easergy_t300 -
schneider-electric easergy_c5_firmware *
schneider-electric easergy_c5 -
schneider-electric micom_c264_firmware *
schneider-electric micom_c264 -
schneider-electric pacis_gtw_firmware 5.1
schneider-electric pacis_gtw_firmware 5.2
schneider-electric pacis_gtw_firmware 6.1
schneider-electric pacis_gtw_firmware 6.3
schneider-electric pacis_gtw_firmware 6.3
schneider-electric pacis_gtw -
schneider-electric saitel_dp_firmware *
schneider-electric saitel_dp -
schneider-electric epas_gtw_firmware 6.4
schneider-electric epas_gtw_firmware 6.4
schneider-electric epas_gtw -
schneider-electric saitel_dr_firmware *
schneider-electric saitel_dr -
schneider-electric scd2200_firmware *
schneider-electric cp-3 -
schneider-electric mc-31 -
rockwellautomation aadvance_controller *
rockwellautomation isagraf_free_runtime *
rockwellautomation isagraf_runtime *
rockwellautomation micro810_firmware -
rockwellautomation micro810 -
rockwellautomation micro820_firmware -
rockwellautomation micro820 -
rockwellautomation micro830_firmware -
rockwellautomation micro830 -
rockwellautomation micro850_firmware -
rockwellautomation micro850 -
rockwellautomation micro870_firmware -
rockwellautomation micro870 -
xylem multismart_firmware *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E07AFED6-47CC-4A19-80DB-C537F4F07736",
              "versionEndIncluding": "2.7.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "45E6C3FA-001D-449A-A512-327FA0C9AC5A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "01E1BC45-FFB3-4D5A-BA09-BA56A492E784",
              "versionEndExcluding": "1.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2EF5114-E9EB-47E1-A388-0963337906C6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "17A5F6A2-32F6-4CDA-B2FE-EAA86B6BC43F",
              "versionEndExcluding": "d6.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4F6A5C4-E0B2-44F2-823F-9E9C59E7B1F5",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*",
              "matchCriteriaId": "716B1453-6203-4E7C-947D-71A031F79B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*",
              "matchCriteriaId": "05986825-76CD-486D-941A-E69A084F2A3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*",
              "matchCriteriaId": "F59F968F-E480-4262-9754-BBC180E1AE24",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*",
              "matchCriteriaId": "514C1283-E965-4543-991B-24FD5AA07D58",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*",
              "matchCriteriaId": "E3FDEC1C-930B-4B8D-A67A-1D46E2069A9B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2240540D-73BB-47F1-A8CA-844DC6B00CE6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC5965EE-EB40-443A-BFDE-E97BD1C0F4E3",
              "versionEndIncluding": "11.06.21",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6D73382-1957-4CC7-953F-D57C005D63B0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*",
              "matchCriteriaId": "6011641C-4319-4FC3-9EB4-F8537A2C50C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*",
              "matchCriteriaId": "A08C5894-6894-44B7-809C-542732BDE84B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4034AC56-BEC6-49EA-9C42-6D0AE360B7E1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "47A24A85-B912-4A15-AB2E-BF2EE739686F",
              "versionEndIncluding": "11.06.12",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E65C2AD5-0079-47AA-82F3-F9335DCFA0AA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D556CAB-DA72-4978-BB45-5B2834C03061",
              "versionEndIncluding": "10024",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C543522-AD89-48DD-90BB-47D686E93ADF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "53C778F7-64DA-4FD4-BB7F-2E5BB8BDB774",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "81F6F3FE-B508-4482-B832-992242F80D30",
              "versionEndIncluding": "1.40",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*",
              "matchCriteriaId": "6B1C6230-85E9-4053-90EB-715919960F80",
              "versionEndIncluding": "6.6.8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B3B8CEE-D6C8-44D9-B601-F862185A6075",
              "versionEndExcluding": "6.0",
              "versionStartIncluding": "5.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5798DD01-C49B-4DA9-9E83-2C875A345A1A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7CBC81B7-2559-46EB-A129-0456442C06D9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9FCA425-ACD4-4F6F-97CF-3B05A1C003E8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7635A8EC-2D15-4BC6-938C-DC30AA21BEAB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BFBB963-DD14-405D-B9ED-6277354A5A57",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8EE48F31-B3FE-463F-B366-05116E4093DE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8EEDFAA2-4E38-457E-9E50-802984D1C0E6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8BD0226-7434-4849-AD0D-35AB5A793F25",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CAFD020B-28D9-4EC5-A282-4D42DC02A34C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "09DEF107-D1C4-456A-BB02-1731498568FD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F64B0A94-A252-4052-A2C2-CD2374E3CCF2",
              "versionEndExcluding": "3.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application\u2019s directory, which could lead to remote code execution."
    },
    {
      "lang": "es",
      "value": "Algunos comandos usados por el protocolo de Rockwell Automation ISaGRAF Runtime Versiones 4.x y 5.x eXchange Layer (IXL) llevan a cabo varias operaciones de archivo en el sistema de archivos. Dado que el par\u00e1metro que apunta al nombre del archivo no es comprobado en busca de caracteres reservados, es posible que un atacante remoto no autenticado recorra el directorio de una aplicaci\u00f3n, lo que podr\u00eda conllevar a una ejecuci\u00f3n remota de c\u00f3digo"
    }
  ],
  "id": "CVE-2020-25176",
  "lastModified": "2024-11-21T05:17:33.640",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "ics-cert@hq.dhs.gov",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-18T18:15:09.060",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ],
      "source": "ics-cert@hq.dhs.gov",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.