CVE-2020-25176
Summary
| CVE | CVE-2020-25176 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-03-18 18:15:00 UTC |
| Updated | 2022-04-04 20:56:00 UTC |
| Description | Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution. |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multism... | CONFIRM | www.xylem.com | |
| download.schneider-electric.com/files | CONFIRM | download.schneider-electric.com | |
| Rockwell Automation ISaGRAF5 Runtime (Update A) | CISA | CONFIRM | www.cisa.gov | |
| Sign In | CONFIRM | rockwellautomation.custhelp.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Kaspersky reported these vulnerabilities to Rockwell Automation.