What’s Vulnerable › Vulnerabilities

CVE-2020-25176: Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-18 · updated 2026-06-17
• Weakness: CWE-23

Description

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.

Affected products

• Rockwellautomation Aadvance Controller: through 1.40
• Rockwellautomation Isagraf Free Runtime: through 6.6.8
• Rockwell Automation ISaGRAF Runtime: from 5.0 before 6.0 — fixed in 6.0
• Rockwellautomation Micro810 Firmware: all versions
• Rockwellautomation Micro820 Firmware: all versions
• Rockwellautomation Micro830 Firmware: all versions
• Rockwellautomation Micro850 Firmware: all versions
• Rockwellautomation Micro870 Firmware: all versions
• Schneider-Electric Easergy C5 Firmware: before 1.1.0 — fixed in 1.1.0
• Easergy T300 (Firmware version 1.5.2 and older): through 2.7.1
• Schneider-Electric Epas Gtw Firmware: 6.4
• Schneider-Electric Micom C264 Firmware: before d6.1 — fixed in d6.1
• Schneider-Electric Pacis Gtw Firmware: 5.1, 5.2, 6.1, 6.3
• Schneider-Electric Saitel Dp Firmware: through 11.06.21
• Schneider-Electric Saitel Dr Firmware: through 11.06.12
• Schneider-Electric Scd2200 Firmware: through 10024
• Xylem Multismart Firmware: before 3.2.0 — fixed in 3.2.0

How to fix

Upgrade to a fixed version: Rockwell Automation ISaGRAF Runtime 6.0; Schneider-Electric Easergy C5 Firmware 1.1.0; Schneider-Electric Micom C264 Firmware d6.1; Xylem Multismart Firmware 3.2.0. Check the vendor advisory for mitigations.

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
• https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
• https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
• https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
• https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf

Get alerted when CVE-2020-25176 or the next vulnerability affects your stack