CVEvulnerability

CVE-2020-25176

9.8 CRITICAL Published 2022-03-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-22, CWE-23

Description

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.

Affected configurations

• schneider-electric easergy t300 firmware (<= 2.7.1) • schneider-electric easergy c5 firmware (< 1.1.0) • schneider-electric micom c264 firmware (< d6.1) • schneider-electric pacis gtw firmware 5.1 • schneider-electric pacis gtw firmware 5.2 • schneider-electric pacis gtw firmware 6.1 • schneider-electric pacis gtw firmware 6.3 • schneider-electric saitel dp firmware (<= 11.06.21) • schneider-electric epas gtw firmware 6.4 • schneider-electric saitel dr firmware (<= 11.06.12) • schneider-electric scd2200 firmware (<= 10024) • rockwellautomation aadvance controller (<= 1.40) • rockwellautomation isagraf free runtime (<= 6.6.8) • rockwellautomation isagraf runtime (>= 5.0 < 6.0) • rockwellautomation micro810 firmware • rockwellautomation micro820 firmware • rockwellautomation micro830 firmware • rockwellautomation micro850 firmware • rockwellautomation micro870 firmware • xylem multismart firmware (< 3.2.0)

Related

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-23 Relative Path Traversal weakness

References