What’s Vulnerable › Vulnerabilities

CVE-2020-25184: Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-18 · updated 2026-06-17
• Weakness: CWE-256

Description

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.

Affected products

• Rockwellautomation Aadvance Controller: through 1.40
• Rockwellautomation Isagraf Free Runtime: through 6.6.8
• Rockwell Automation ISaGRAF Runtime: from 5.0 before 6.0 — fixed in 6.0
• Rockwellautomation Micro810 Firmware: all versions
• Rockwellautomation Micro820 Firmware: all versions
• Rockwellautomation Micro830 Firmware: all versions
• Rockwellautomation Micro850 Firmware: all versions
• Rockwellautomation Micro870 Firmware: all versions
• Schneider-Electric Easergy C5 Firmware: before 1.1.0 — fixed in 1.1.0
• Easergy T300 (Firmware version 1.5.2 and older): through 2.7.1
• Schneider-Electric Epas Gtw Firmware: 6.4
• Schneider-Electric Micom C264 Firmware: before d6.1 — fixed in d6.1
• Schneider-Electric Pacis Gtw Firmware: 5.1, 5.2, 6.1, 6.3
• Schneider-Electric Saitel Dp Firmware: through 11.06.21
• Schneider-Electric Saitel Dr Firmware: through 11.06.12
• Schneider-Electric Scd2200 Firmware: through 10024
• Xylem Multismart Firmware: before 3.2.0 — fixed in 3.2.0

How to fix

Upgrade to a fixed version: Rockwell Automation ISaGRAF Runtime 6.0; Schneider-Electric Easergy C5 Firmware 1.1.0; Schneider-Electric Micom C264 Firmware d6.1; Xylem Multismart Firmware 3.2.0. Check the vendor advisory for mitigations.

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
• https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
• https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
• https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01
• https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf

Get alerted when CVE-2020-25184 or the next vulnerability affects your stack