2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2020-25176" ,
"sourceIdentifier" : "ics-cert@hq.dhs.gov" ,
"published" : "2022-03-18T18:15:09.060" ,
"lastModified" : "2022-04-04T20:56:17.697" ,
"vulnStatus" : "Analyzed" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application\u2019s directory, which could lead to remote code execution."
} ,
{
"lang" : "es" ,
"value" : "Algunos comandos usados por el protocolo de Rockwell Automation ISaGRAF Runtime Versiones 4.x y 5.x eXchange Layer (IXL) llevan a cabo varias operaciones de archivo en el sistema de archivos. Dado que el par\u00e1metro que apunta al nombre del archivo no es comprobado en busca de caracteres reservados, es posible que un atacante remoto no autenticado recorra el directorio de una aplicaci\u00f3n, lo que podr\u00eda conllevar a una ejecuci\u00f3n remota de c\u00f3digo"
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 9.8 ,
"baseSeverity" : "CRITICAL"
} ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 5.9
} ,
{
"source" : "ics-cert@hq.dhs.gov" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "HIGH" ,
"userInteraction" : "NONE" ,
"scope" : "CHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 9.1 ,
"baseSeverity" : "CRITICAL"
} ,
"exploitabilityScore" : 2.3 ,
"impactScore" : 6.0
}
] ,
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C" ,
"accessVector" : "NETWORK" ,
"accessComplexity" : "MEDIUM" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "COMPLETE" ,
"integrityImpact" : "COMPLETE" ,
"availabilityImpact" : "COMPLETE" ,
"baseScore" : 9.3
} ,
"baseSeverity" : "HIGH" ,
"exploitabilityScore" : 8.6 ,
"impactScore" : 10.0 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-22"
}
]
} ,
{
"source" : "ics-cert@hq.dhs.gov" ,
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-23"
}
]
}
] ,
"configurations" : [
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "45E6C3FA-001D-449A-A512-327FA0C9AC5A"
2023-04-24 12:24:31 +02:00
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "2.7.1" ,
"matchCriteriaId" : "E07AFED6-47CC-4A19-80DB-C537F4F07736"
2023-04-24 12:24:31 +02:00
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "A2EF5114-E9EB-47E1-A388-0963337906C6"
2023-04-24 12:24:31 +02:00
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "1.1.0" ,
"matchCriteriaId" : "01E1BC45-FFB3-4D5A-BA09-BA56A492E784"
2023-04-24 12:24:31 +02:00
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "A4F6A5C4-E0B2-44F2-823F-9E9C59E7B1F5"
2023-04-24 12:24:31 +02:00
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "d6.1" ,
"matchCriteriaId" : "17A5F6A2-32F6-4CDA-B2FE-EAA86B6BC43F"
2023-04-24 12:24:31 +02:00
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
2024-05-19 02:03:31 +00:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "2240540D-73BB-47F1-A8CA-844DC6B00CE6"
}
]
} ,
2023-04-24 12:24:31 +02:00
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*" ,
"matchCriteriaId" : "716B1453-6203-4E7C-947D-71A031F79B3E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*" ,
"matchCriteriaId" : "05986825-76CD-486D-941A-E69A084F2A3E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*" ,
"matchCriteriaId" : "F59F968F-E480-4262-9754-BBC180E1AE24"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*" ,
"matchCriteriaId" : "514C1283-E965-4543-991B-24FD5AA07D58"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*" ,
"matchCriteriaId" : "E3FDEC1C-930B-4B8D-A67A-1D46E2069A9B"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E6D73382-1957-4CC7-953F-D57C005D63B0"
2023-04-24 12:24:31 +02:00
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "11.06.21" ,
"matchCriteriaId" : "AC5965EE-EB40-443A-BFDE-E97BD1C0F4E3"
2023-04-24 12:24:31 +02:00
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "4034AC56-BEC6-49EA-9C42-6D0AE360B7E1"
2023-04-24 12:24:31 +02:00
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*" ,
"matchCriteriaId" : "6011641C-4319-4FC3-9EB4-F8537A2C50C9"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*" ,
"matchCriteriaId" : "A08C5894-6894-44B7-809C-542732BDE84B"
2023-04-24 12:24:31 +02:00
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E65C2AD5-0079-47AA-82F3-F9335DCFA0AA"
2023-04-24 12:24:31 +02:00
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
2024-05-19 02:03:31 +00:00
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "11.06.12" ,
"matchCriteriaId" : "47A24A85-B912-4A15-AB2E-BF2EE739686F"
2023-04-24 12:24:31 +02:00
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7C543522-AD89-48DD-90BB-47D686E93ADF"
} ,
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "53C778F7-64DA-4FD4-BB7F-2E5BB8BDB774"
}
]
2024-05-19 02:03:31 +00:00
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "10024" ,
"matchCriteriaId" : "6D556CAB-DA72-4978-BB45-5B2834C03061"
}
]
2023-04-24 12:24:31 +02:00
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "1.40" ,
"matchCriteriaId" : "81F6F3FE-B508-4482-B832-992242F80D30"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*" ,
"versionEndIncluding" : "6.6.8" ,
"matchCriteriaId" : "6B1C6230-85E9-4053-90EB-715919960F80"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "5.0" ,
"versionEndExcluding" : "6.0" ,
"matchCriteriaId" : "7B3B8CEE-D6C8-44D9-B601-F862185A6075"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "5798DD01-C49B-4DA9-9E83-2C875A345A1A"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7CBC81B7-2559-46EB-A129-0456442C06D9"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "D9FCA425-ACD4-4F6F-97CF-3B05A1C003E8"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7635A8EC-2D15-4BC6-938C-DC30AA21BEAB"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "9BFBB963-DD14-405D-B9ED-6277354A5A57"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "8EE48F31-B3FE-463F-B366-05116E4093DE"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "8EEDFAA2-4E38-457E-9E50-802984D1C0E6"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "B8BD0226-7434-4849-AD0D-35AB5A793F25"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CAFD020B-28D9-4EC5-A282-4D42DC02A34C"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "09DEF107-D1C4-456A-BB02-1731498568FD"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "3.2.0" ,
"matchCriteriaId" : "F64B0A94-A252-4052-A2C2-CD2374E3CCF2"
}
]
}
]
}
] ,
"references" : [
{
"url" : "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04" ,
"source" : "ics-cert@hq.dhs.gov" ,
"tags" : [
"Mitigation" ,
"Vendor Advisory"
]
} ,
{
"url" : "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699" ,
"source" : "ics-cert@hq.dhs.gov" ,
"tags" : [
"Permissions Required"
]
} ,
{
"url" : "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01" ,
"source" : "ics-cert@hq.dhs.gov" ,
"tags" : [
"Third Party Advisory" ,
"US Government Resource"
]
} ,
{
"url" : "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf" ,
"source" : "ics-cert@hq.dhs.gov" ,
"tags" : [
"Third Party Advisory"
]
}
]
}
