What’s Vulnerable › Vulnerabilities

CVE-2020-25180: Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-18 · updated 2026-06-17
• Weakness: CWE-321

Description

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device.

Affected products

• Rockwellautomation Aadvance Controller: through 1.40
• Rockwellautomation Isagraf Free Runtime: through 6.6.8
• Rockwell Automation ISaGRAF Runtime: from 5.0 before 6.0 — fixed in 6.0
• Rockwellautomation Micro810 Firmware: all versions
• Rockwellautomation Micro820 Firmware: all versions
• Rockwellautomation Micro830 Firmware: all versions
• Rockwellautomation Micro850 Firmware: all versions
• Rockwellautomation Micro870 Firmware: all versions
• Schneider-Electric Easergy C5 Firmware: before 1.1.0 — fixed in 1.1.0
• Easergy T300 (Firmware version 1.5.2 and older): through 2.7.1
• Schneider-Electric Epas Gtw Firmware: 6.4
• Schneider-Electric Micom C264 Firmware: before d6.1 — fixed in d6.1
• Schneider-Electric Pacis Gtw Firmware: 5.1, 5.2, 6.1, 6.3
• Schneider-Electric Saitel Dp Firmware: through 11.06.21
• Schneider-Electric Saitel Dr Firmware: through 11.06.12
• Schneider-Electric Scd2200 Firmware: through 10024
• Xylem Multismart Firmware: before 3.2.0 — fixed in 3.2.0

How to fix

Upgrade to a fixed version: Rockwell Automation ISaGRAF Runtime 6.0; Schneider-Electric Easergy C5 Firmware 1.1.0; Schneider-Electric Micom C264 Firmware d6.1; Xylem Multismart Firmware 3.2.0. Check the vendor advisory for mitigations.

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
• https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
• https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
• https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
• https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf

Get alerted when CVE-2020-25180 or the next vulnerability affects your stack