Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
7 vulnerabilities found for Saitel DP by Schneider Electric
CVE-2026-4827 (GCVE-0-2026-4827)
Vulnerability from nvd – Published: 2026-05-12 12:24 – Updated: 2026-05-14 17:38
VLAI
EPSS
VEX
Title
Insufficient Entropy vulnerability on Multiple Products
Summary
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 12:39 UTC
CWE
- CWE-331 - Insufficient entropy
Assigner
References
1 reference
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Schneider Electric | Easergy MiCOM C264 |
Affected:
Versions D6.x
Affected: Versions D7.33 and prior |
|
| Schneider Electric | Easergy C5 |
Affected:
Version 1.1.17 and prior
|
|
| Schneider Electric | Easergy MiCOM P30 |
Affected:
P139 version prior to P139.678.700
Affected: P437 version prior to P437.678.700 Affected: P439 version prior to P439.678.700 Affected: P532 version prior to P532.678.700 Affected: P539 version prior to P539.678.700 Affected: P631 version prior to P631.678.700 Affected: P632 version prior to P632.678.700 Affected: P633 version prior to P633.678.700 Affected: P634 version prior to P634.678.700 Affected: P633 version P633.680.700 only Affected: P634 version P634.680.700 only Affected: P138 version prior to P138.677.700 Affected: P436 version prior to P436.677.701 Affected: P438 version prior to P438.677.701 Affected: P638 version prior to P638.677.700 Affected: C434 version prior to C434.679.700 |
|
| Schneider Electric | Easergy MiCOM P40 |
Affected:
Series model numbers with Protocol Option bit as G, H or L and all firmware versions
|
|
| Schneider Electric | EcoStruxure™ Power Automation System Gateway (EPAS-GTW) |
Affected:
Version 6.4.616.200.100 and prior
|
|
| Schneider Electric | EcoStruxure™ Power Automation System User Interface (EPAS-UI) |
Affected:
Version 3.0.3 and prior
|
|
| Schneider Electric | EcoStruxure™ Power Operation |
Affected:
Version 2022 CU6 and prior
Affected: Version 2024 CU2 and prior |
|
| Schneider Electric | iPMFLS |
Affected:
Version 64.2025.0.13 and prior
|
|
| Schneider Electric | PowerLogic™ P5 Protection Relay |
Affected:
V02.502.103 and prior
|
|
| Schneider Electric | PowerLogic™ P7 Protection and Control Platform |
Affected:
V02.002.002 and prior
|
|
| Schneider Electric | PowerLogic™ T300 |
Affected:
Version 2.9.4 and prior
|
|
| Schneider Electric | PowerLogic™ T500 |
Affected:
Version 11.08.02 and prior
|
|
| Schneider Electric | Saitel DP |
Affected:
Version 11.06.36 and prior
|
|
| Schneider Electric | EasyLogic T150 (formerly Saitel DR) |
Affected:
Version 11.06.30 and prior
|
Date Public
2026-05-12 16:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4827",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T12:39:02.210471Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T12:39:31.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Easergy MiCOM C264",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions D6.x"
},
{
"status": "affected",
"version": "Versions D7.33 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easergy C5",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 1.1.17 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easergy MiCOM P30",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "P139 version prior to P139.678.700"
},
{
"status": "affected",
"version": "P437 version prior to P437.678.700"
},
{
"status": "affected",
"version": "P439 version prior to P439.678.700"
},
{
"status": "affected",
"version": "P532 version prior to P532.678.700"
},
{
"status": "affected",
"version": "P539 version prior to P539.678.700"
},
{
"status": "affected",
"version": "P631 version prior to P631.678.700"
},
{
"status": "affected",
"version": "P632 version prior to P632.678.700"
},
{
"status": "affected",
"version": "P633 version prior to P633.678.700"
},
{
"status": "affected",
"version": "P634 version prior to P634.678.700"
},
{
"status": "affected",
"version": "P633 version P633.680.700 only"
},
{
"status": "affected",
"version": "P634 version P634.680.700 only"
},
{
"status": "affected",
"version": "P138 version prior to P138.677.700"
},
{
"status": "affected",
"version": "P436 version prior to P436.677.701"
},
{
"status": "affected",
"version": "P438 version prior to P438.677.701"
},
{
"status": "affected",
"version": "P638 version prior to P638.677.700"
},
{
"status": "affected",
"version": "C434 version prior to C434.679.700"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easergy MiCOM P40",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Series model numbers with Protocol Option bit as G, H or L and all firmware versions"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EcoStruxure\u2122 Power Automation System Gateway (EPAS-GTW)",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 6.4.616.200.100 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EcoStruxure\u2122 Power Automation System User Interface (EPAS-UI)",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 3.0.3 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EcoStruxure\u2122 Power Operation",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 2022 CU6 and prior"
},
{
"status": "affected",
"version": "Version 2024 CU2 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "iPMFLS",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 64.2025.0.13 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PowerLogic\u2122 P5 Protection Relay",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "V02.502.103 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PowerLogic\u2122 P7 Protection and Control Platform",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "V02.002.002 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PowerLogic\u2122 T300",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 2.9.4 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PowerLogic\u2122 T500",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 11.08.02 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Saitel DP",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 11.06.36 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EasyLogic T150 (formerly Saitel DR)",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 11.06.30 and prior"
}
]
}
],
"datePublic": "2026-05-12T16:49:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CWE\u2011331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session\u2011management protections."
}
],
"value": "CWE\u2011331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session\u2011management protections."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-331",
"description": "CWE-331 Insufficient entropy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T17:38:38.647Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2026-132-02.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insufficient Entropy vulnerability on Multiple Products",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2026-4827",
"datePublished": "2026-05-12T12:24:22.928Z",
"dateReserved": "2026-03-25T14:07:29.111Z",
"dateUpdated": "2026-05-14T17:38:38.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4827 (GCVE-0-2026-4827)
Vulnerability from cvelistv5 – Published: 2026-05-12 12:24 – Updated: 2026-05-14 17:38
VLAI
EPSS
VEX
Title
Insufficient Entropy vulnerability on Multiple Products
Summary
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 12:39 UTC
CWE
- CWE-331 - Insufficient entropy
Assigner
References
1 reference
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Schneider Electric | Easergy MiCOM C264 |
Affected:
Versions D6.x
Affected: Versions D7.33 and prior |
|
| Schneider Electric | Easergy C5 |
Affected:
Version 1.1.17 and prior
|
|
| Schneider Electric | Easergy MiCOM P30 |
Affected:
P139 version prior to P139.678.700
Affected: P437 version prior to P437.678.700 Affected: P439 version prior to P439.678.700 Affected: P532 version prior to P532.678.700 Affected: P539 version prior to P539.678.700 Affected: P631 version prior to P631.678.700 Affected: P632 version prior to P632.678.700 Affected: P633 version prior to P633.678.700 Affected: P634 version prior to P634.678.700 Affected: P633 version P633.680.700 only Affected: P634 version P634.680.700 only Affected: P138 version prior to P138.677.700 Affected: P436 version prior to P436.677.701 Affected: P438 version prior to P438.677.701 Affected: P638 version prior to P638.677.700 Affected: C434 version prior to C434.679.700 |
|
| Schneider Electric | Easergy MiCOM P40 |
Affected:
Series model numbers with Protocol Option bit as G, H or L and all firmware versions
|
|
| Schneider Electric | EcoStruxure™ Power Automation System Gateway (EPAS-GTW) |
Affected:
Version 6.4.616.200.100 and prior
|
|
| Schneider Electric | EcoStruxure™ Power Automation System User Interface (EPAS-UI) |
Affected:
Version 3.0.3 and prior
|
|
| Schneider Electric | EcoStruxure™ Power Operation |
Affected:
Version 2022 CU6 and prior
Affected: Version 2024 CU2 and prior |
|
| Schneider Electric | iPMFLS |
Affected:
Version 64.2025.0.13 and prior
|
|
| Schneider Electric | PowerLogic™ P5 Protection Relay |
Affected:
V02.502.103 and prior
|
|
| Schneider Electric | PowerLogic™ P7 Protection and Control Platform |
Affected:
V02.002.002 and prior
|
|
| Schneider Electric | PowerLogic™ T300 |
Affected:
Version 2.9.4 and prior
|
|
| Schneider Electric | PowerLogic™ T500 |
Affected:
Version 11.08.02 and prior
|
|
| Schneider Electric | Saitel DP |
Affected:
Version 11.06.36 and prior
|
|
| Schneider Electric | EasyLogic T150 (formerly Saitel DR) |
Affected:
Version 11.06.30 and prior
|
Date Public
2026-05-12 16:49
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4827",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T12:39:02.210471Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T12:39:31.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Easergy MiCOM C264",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions D6.x"
},
{
"status": "affected",
"version": "Versions D7.33 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easergy C5",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 1.1.17 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easergy MiCOM P30",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "P139 version prior to P139.678.700"
},
{
"status": "affected",
"version": "P437 version prior to P437.678.700"
},
{
"status": "affected",
"version": "P439 version prior to P439.678.700"
},
{
"status": "affected",
"version": "P532 version prior to P532.678.700"
},
{
"status": "affected",
"version": "P539 version prior to P539.678.700"
},
{
"status": "affected",
"version": "P631 version prior to P631.678.700"
},
{
"status": "affected",
"version": "P632 version prior to P632.678.700"
},
{
"status": "affected",
"version": "P633 version prior to P633.678.700"
},
{
"status": "affected",
"version": "P634 version prior to P634.678.700"
},
{
"status": "affected",
"version": "P633 version P633.680.700 only"
},
{
"status": "affected",
"version": "P634 version P634.680.700 only"
},
{
"status": "affected",
"version": "P138 version prior to P138.677.700"
},
{
"status": "affected",
"version": "P436 version prior to P436.677.701"
},
{
"status": "affected",
"version": "P438 version prior to P438.677.701"
},
{
"status": "affected",
"version": "P638 version prior to P638.677.700"
},
{
"status": "affected",
"version": "C434 version prior to C434.679.700"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Easergy MiCOM P40",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Series model numbers with Protocol Option bit as G, H or L and all firmware versions"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EcoStruxure\u2122 Power Automation System Gateway (EPAS-GTW)",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 6.4.616.200.100 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EcoStruxure\u2122 Power Automation System User Interface (EPAS-UI)",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 3.0.3 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EcoStruxure\u2122 Power Operation",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 2022 CU6 and prior"
},
{
"status": "affected",
"version": "Version 2024 CU2 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "iPMFLS",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 64.2025.0.13 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PowerLogic\u2122 P5 Protection Relay",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "V02.502.103 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PowerLogic\u2122 P7 Protection and Control Platform",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "V02.002.002 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PowerLogic\u2122 T300",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 2.9.4 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PowerLogic\u2122 T500",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 11.08.02 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Saitel DP",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 11.06.36 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EasyLogic T150 (formerly Saitel DR)",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Version 11.06.30 and prior"
}
]
}
],
"datePublic": "2026-05-12T16:49:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CWE\u2011331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session\u2011management protections."
}
],
"value": "CWE\u2011331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session\u2011management protections."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-331",
"description": "CWE-331 Insufficient entropy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T17:38:38.647Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2026-132-02.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insufficient Entropy vulnerability on Multiple Products",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2026-4827",
"datePublished": "2026-05-12T12:24:22.928Z",
"dateReserved": "2026-03-25T14:07:29.111Z",
"dateUpdated": "2026-05-14T17:38:38.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
VAR-202106-1996
Vulnerability from variot - Updated: 2023-12-18 11:46Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution. Rockwell Automation Provided by the company ISaGRAF5 Runtime The following multiple vulnerabilities exist in. * Relative path traversal (CWE-23) - CVE-2020-25176 ‥ * Plaintext storage of credentials (CWE-256) - CVE-2020-25184 ‥ * Sending important information in clear text (CWE-319) - CVE-2020-25178 ‥ * DLL File search path is not properly controlled (CWE-427) - CVE-2020-25182 ‥ * Use of hard-coded encryption key (CWE-321) - CVE-2020-25180The expected impact depends on each vulnerability, but it may be affected as follows. * Arbitrary code executed by a remote third party - CVE-2020-25176 ‥ * Passwords and information stolen by local users - CVE-2020-25184 ‥ * Files are uploaded, read and deleted by a remote third party - CVE-2020-25178 ‥ * ISaGRAF Runtime But Microsoft Windows Any code executed by a local third party when running on - CVE-2020-25182 ‥ * Information stolen by a remote third party - CVE-2020-25180. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202106-1996",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "isagraf free runtime",
"scope": "lte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.6.8"
},
{
"model": "aadvance controller",
"scope": "lte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "1.40"
},
{
"model": "micro820",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "scd2200",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "10024"
},
{
"model": "isagraf runtime",
"scope": "lt",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.0"
},
{
"model": "micro850",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "5.2"
},
{
"model": "easergy t300",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "2.7.1"
},
{
"model": "isagraf runtime",
"scope": "gte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "5.0"
},
{
"model": "micro830",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "easergy c5",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "1.1.0"
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.1"
},
{
"model": "micro810",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "saitel dr",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "11.06.12"
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.3"
},
{
"model": "micro870",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "5.1"
},
{
"model": "saitel dp",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "11.06.21"
},
{
"model": "epas gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.4"
},
{
"model": "multismart",
"scope": "lt",
"trust": 1.0,
"vendor": "xylem",
"version": "3.2.0"
},
{
"model": "micom c264",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "d6.1"
},
{
"model": "multismart gen-1",
"scope": null,
"trust": 0.8,
"vendor": "xylem",
"version": null
},
{
"model": "alspa s6 mfc3000",
"scope": null,
"trust": 0.8,
"vendor": "ge steam power",
"version": null
},
{
"model": "aadvance controller",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "micro800",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "alspa s6 mfc1000",
"scope": null,
"trust": 0.8,
"vendor": "ge steam power",
"version": null
},
{
"model": "multismart gen-2",
"scope": null,
"trust": 0.8,
"vendor": "xylem",
"version": null
},
{
"model": "isagraf free runtime",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "isagraf runtime",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25176"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.7.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.1.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "d6.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.06.21",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.06.12",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10024",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.40",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*",
"cpe_name": [],
"versionEndIncluding": "6.6.8",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25176"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kaspersky reported these vulnerabilities to Rockwell Automation.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-530"
}
],
"trust": 0.6
},
"cve": "CVE-2020-25176",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-179128",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "ics-cert@hq.dhs.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.3,
"impactScore": 6.0,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "High",
"baseScore": 9.1,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2021-001882",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "High",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-25176",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2020-25176",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "IPA",
"id": "JVNDB-2021-001882",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202106-530",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-179128",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179128"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25176"
},
{
"db": "NVD",
"id": "CVE-2020-25176"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-530"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application\u2019s directory, which could lead to remote code execution. Rockwell Automation Provided by the company ISaGRAF5 Runtime The following multiple vulnerabilities exist in. * Relative path traversal (CWE-23) - CVE-2020-25176 \u2025 * Plaintext storage of credentials (CWE-256) - CVE-2020-25184 \u2025 * Sending important information in clear text (CWE-319) - CVE-2020-25178 \u2025 * DLL File search path is not properly controlled (CWE-427) - CVE-2020-25182 \u2025 * Use of hard-coded encryption key (CWE-321) - CVE-2020-25180The expected impact depends on each vulnerability, but it may be affected as follows. * Arbitrary code executed by a remote third party - CVE-2020-25176 \u2025 * Passwords and information stolen by local users - CVE-2020-25184 \u2025 * Files are uploaded, read and deleted by a remote third party - CVE-2020-25178 \u2025 * ISaGRAF Runtime But Microsoft Windows Any code executed by a local third party when running on - CVE-2020-25182 \u2025 * Information stolen by a remote third party - CVE-2020-25180. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25176"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "VULHUB",
"id": "VHN-179128"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-25176",
"trust": 2.5
},
{
"db": "ICS CERT",
"id": "ICSA-20-280-01",
"trust": 2.5
},
{
"db": "SCHNEIDER",
"id": "SEVD-2021-159-04",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90811375",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882",
"trust": 0.8
},
{
"db": "CS-HELP",
"id": "SB2021041363",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021120106",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021060920",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2163",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202106-530",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-179128",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179128"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25176"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-530"
}
]
},
"id": "VAR-202106-1996",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-179128"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:46:56.948000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Xylem\u00a0Product\u00a0Security\u00a0Advisory",
"trust": 0.8,
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
},
{
"title": "Rockwell Automation ISaGRAF Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=153710"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-530"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.1
},
{
"problemtype": "Relative path traversal (CWE-23) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Plaintext storage of credentials (CWE-256) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Sending important information in clear text (CWE-319) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use of hard-coded encryption key (CWE-321) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Uncontrolled search path elements (CWE-427) [IPA Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179128"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25176"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://download.schneider-electric.com/files?p_doc_ref=sevd-2021-159-04"
},
{
"trust": 1.7,
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
},
{
"trust": 1.7,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"
},
{
"trust": 1.7,
"url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"
},
{
"trust": 1.4,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-280-01"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu90811375"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2020-25176/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2163"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021060920"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021120106"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179128"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25176"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-530"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-179128"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25176"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-530"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-18T00:00:00",
"db": "VULHUB",
"id": "VHN-179128"
},
{
"date": "2021-06-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"date": "2022-03-18T18:15:09.060000",
"db": "NVD",
"id": "CVE-2020-25176"
},
{
"date": "2021-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2021-06-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-530"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-04-04T00:00:00",
"db": "VULHUB",
"id": "VHN-179128"
},
{
"date": "2021-06-21T08:28:00",
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"date": "2022-04-04T20:56:17.697000",
"db": "NVD",
"id": "CVE-2020-25176"
},
{
"date": "2021-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2022-04-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-530"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-530"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Rockwell\u00a0Automation\u00a0 Made \u00a0ISaGRAF5\u00a0Runtime\u00a0 Multiple vulnerabilities in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
}
],
"trust": 0.6
}
}
VAR-202106-1998
Vulnerability from variot - Updated: 2023-12-18 11:15ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files. Rockwell Automation Provided by the company ISaGRAF5 Runtime The following multiple vulnerabilities exist in. * Relative path traversal (CWE-23) - CVE-2020-25176 ‥ * Plaintext storage of credentials (CWE-256) - CVE-2020-25184 ‥ * Sending important information in clear text (CWE-319) - CVE-2020-25178 ‥ * DLL File search path is not properly controlled (CWE-427) - CVE-2020-25182 ‥ * Use of hard-coded encryption key (CWE-321) - CVE-2020-25180The expected impact depends on each vulnerability, but it may be affected as follows. * Arbitrary code executed by a remote third party - CVE-2020-25176 ‥ * Passwords and information stolen by local users - CVE-2020-25184 ‥ * Files are uploaded, read and deleted by a remote third party - CVE-2020-25178 ‥ * ISaGRAF Runtime But Microsoft Windows Any code executed by a local third party when running on - CVE-2020-25182 ‥ * Information stolen by a remote third party - CVE-2020-25180. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Rockwell Automation ISaGRAF is an automation software technology developed by Rockwell Automation in the United States for creating integrated automation solutions. It is designed to be scalable and portable, suitable for developing small controllers and large distributed automation systems
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202106-1998",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "isagraf free runtime",
"scope": "lte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.6.8"
},
{
"model": "aadvance controller",
"scope": "lte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "1.40"
},
{
"model": "micro820",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "scd2200",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "10024"
},
{
"model": "isagraf runtime",
"scope": "lt",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.0"
},
{
"model": "micro850",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "5.2"
},
{
"model": "easergy t300",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "2.7.1"
},
{
"model": "isagraf runtime",
"scope": "gte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "5.0"
},
{
"model": "micro830",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "easergy c5",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "1.1.0"
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.1"
},
{
"model": "micro810",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "saitel dr",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "11.06.12"
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.3"
},
{
"model": "micro870",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "5.1"
},
{
"model": "saitel dp",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "11.06.21"
},
{
"model": "epas gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.4"
},
{
"model": "multismart",
"scope": "lt",
"trust": 1.0,
"vendor": "xylem",
"version": "3.2.0"
},
{
"model": "micom c264",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "d6.1"
},
{
"model": "multismart gen-1",
"scope": null,
"trust": 0.8,
"vendor": "xylem",
"version": null
},
{
"model": "alspa s6 mfc3000",
"scope": null,
"trust": 0.8,
"vendor": "ge steam power",
"version": null
},
{
"model": "aadvance controller",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "micro800",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "alspa s6 mfc1000",
"scope": null,
"trust": 0.8,
"vendor": "ge steam power",
"version": null
},
{
"model": "multismart gen-2",
"scope": null,
"trust": 0.8,
"vendor": "xylem",
"version": null
},
{
"model": "isagraf free runtime",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "isagraf runtime",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25178"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.7.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.1.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "d6.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.06.21",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.06.12",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10024",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.40",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*",
"cpe_name": [],
"versionEndIncluding": "6.6.8",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25178"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kaspersky reported these vulnerabilities to Rockwell Automation.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-528"
}
],
"trust": 0.6
},
"cve": "CVE-2020-25178",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-179130",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "ics-cert@hq.dhs.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2021-001882",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-25178",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2020-25178",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "IPA",
"id": "JVNDB-2021-001882",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202106-528",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-179130",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179130"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25178"
},
{
"db": "NVD",
"id": "CVE-2020-25178"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-528"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files. Rockwell Automation Provided by the company ISaGRAF5 Runtime The following multiple vulnerabilities exist in. * Relative path traversal (CWE-23) - CVE-2020-25176 \u2025 * Plaintext storage of credentials (CWE-256) - CVE-2020-25184 \u2025 * Sending important information in clear text (CWE-319) - CVE-2020-25178 \u2025 * DLL File search path is not properly controlled (CWE-427) - CVE-2020-25182 \u2025 * Use of hard-coded encryption key (CWE-321) - CVE-2020-25180The expected impact depends on each vulnerability, but it may be affected as follows. * Arbitrary code executed by a remote third party - CVE-2020-25176 \u2025 * Passwords and information stolen by local users - CVE-2020-25184 \u2025 * Files are uploaded, read and deleted by a remote third party - CVE-2020-25178 \u2025 * ISaGRAF Runtime But Microsoft Windows Any code executed by a local third party when running on - CVE-2020-25182 \u2025 * Information stolen by a remote third party - CVE-2020-25180. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Rockwell Automation ISaGRAF is an automation software technology developed by Rockwell Automation in the United States for creating integrated automation solutions. It is designed to be scalable and portable, suitable for developing small controllers and large distributed automation systems",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25178"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "VULHUB",
"id": "VHN-179130"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-25178",
"trust": 2.5
},
{
"db": "ICS CERT",
"id": "ICSA-20-280-01",
"trust": 2.5
},
{
"db": "SCHNEIDER",
"id": "SEVD-2021-159-04",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90811375",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882",
"trust": 0.8
},
{
"db": "CS-HELP",
"id": "SB2021041363",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021120106",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021060920",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2163",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202106-528",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-179130",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179130"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25178"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-528"
}
]
},
"id": "VAR-202106-1998",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-179130"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:15:09.347000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Xylem\u00a0Product\u00a0Security\u00a0Advisory",
"trust": 0.8,
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
},
{
"title": "Rockwell Automation ISaGRAF Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=153708"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-528"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-319",
"trust": 1.1
},
{
"problemtype": "Relative path traversal (CWE-23) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Plaintext storage of credentials (CWE-256) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Sending important information in clear text (CWE-319) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use of hard-coded encryption key (CWE-321) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Uncontrolled search path elements (CWE-427) [IPA Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179130"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25178"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://download.schneider-electric.com/files?p_doc_ref=sevd-2021-159-04"
},
{
"trust": 1.7,
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
},
{
"trust": 1.7,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"
},
{
"trust": 1.7,
"url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"
},
{
"trust": 1.4,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-280-01"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu90811375"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2020-25178/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2163"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021060920"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021120106"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179130"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25178"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-528"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-179130"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25178"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-528"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-18T00:00:00",
"db": "VULHUB",
"id": "VHN-179130"
},
{
"date": "2021-06-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"date": "2022-03-18T18:15:09.123000",
"db": "NVD",
"id": "CVE-2020-25178"
},
{
"date": "2021-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2021-06-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-528"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-04-04T00:00:00",
"db": "VULHUB",
"id": "VHN-179130"
},
{
"date": "2021-06-21T08:28:00",
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"date": "2022-04-04T20:57:25.423000",
"db": "NVD",
"id": "CVE-2020-25178"
},
{
"date": "2021-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2022-04-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-528"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-528"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Rockwell\u00a0Automation\u00a0 Made \u00a0ISaGRAF5\u00a0Runtime\u00a0 Multiple vulnerabilities in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-528"
}
],
"trust": 1.2
}
}
VAR-202106-1999
Vulnerability from variot - Updated: 2023-12-18 11:05Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure. Rockwell Automation Provided by the company ISaGRAF5 Runtime The following multiple vulnerabilities exist in. * Relative path traversal (CWE-23) - CVE-2020-25176 ‥ * Plaintext storage of credentials (CWE-256) - CVE-2020-25184 ‥ * Sending important information in clear text (CWE-319) - CVE-2020-25178 ‥ * DLL File search path is not properly controlled (CWE-427) - CVE-2020-25182 ‥ * Use of hard-coded encryption key (CWE-321) - CVE-2020-25180The expected impact depends on each vulnerability, but it may be affected as follows. * Arbitrary code executed by a remote third party - CVE-2020-25176 ‥ * Passwords and information stolen by local users - CVE-2020-25184 ‥ * Files are uploaded, read and deleted by a remote third party - CVE-2020-25178 ‥ * ISaGRAF Runtime But Microsoft Windows Any code executed by a local third party when running on - CVE-2020-25182 ‥ * Information stolen by a remote third party - CVE-2020-25180. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202106-1999",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "isagraf free runtime",
"scope": "lte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.6.8"
},
{
"model": "aadvance controller",
"scope": "lte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "1.40"
},
{
"model": "micro820",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "scd2200",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "10024"
},
{
"model": "isagraf runtime",
"scope": "lt",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.0"
},
{
"model": "micro850",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "5.2"
},
{
"model": "easergy t300",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "2.7.1"
},
{
"model": "isagraf runtime",
"scope": "gte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "5.0"
},
{
"model": "micro830",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "easergy c5",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "1.1.0"
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.1"
},
{
"model": "micro810",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "saitel dr",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "11.06.12"
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.3"
},
{
"model": "micro870",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "5.1"
},
{
"model": "saitel dp",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "11.06.21"
},
{
"model": "epas gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.4"
},
{
"model": "multismart",
"scope": "lt",
"trust": 1.0,
"vendor": "xylem",
"version": "3.2.0"
},
{
"model": "micom c264",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "d6.1"
},
{
"model": "multismart gen-1",
"scope": null,
"trust": 0.8,
"vendor": "xylem",
"version": null
},
{
"model": "alspa s6 mfc3000",
"scope": null,
"trust": 0.8,
"vendor": "ge steam power",
"version": null
},
{
"model": "aadvance controller",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "micro800",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "alspa s6 mfc1000",
"scope": null,
"trust": 0.8,
"vendor": "ge steam power",
"version": null
},
{
"model": "multismart gen-2",
"scope": null,
"trust": 0.8,
"vendor": "xylem",
"version": null
},
{
"model": "isagraf free runtime",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "isagraf runtime",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25184"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.7.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.1.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "d6.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.06.21",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.06.12",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10024",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*",
"cpe_name": [],
"versionEndIncluding": "6.6.8",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.40",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25184"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kaspersky reported these vulnerabilities to Rockwell Automation.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-526"
}
],
"trust": 0.6
},
"cve": "CVE-2020-25184",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "VHN-179137",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ics-cert@hq.dhs.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "IPA",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2021-001882",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-25184",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2020-25184",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "IPA",
"id": "JVNDB-2021-001882",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202106-526",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-179137",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179137"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25184"
},
{
"db": "NVD",
"id": "CVE-2020-25184"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-526"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure. Rockwell Automation Provided by the company ISaGRAF5 Runtime The following multiple vulnerabilities exist in. * Relative path traversal (CWE-23) - CVE-2020-25176 \u2025 * Plaintext storage of credentials (CWE-256) - CVE-2020-25184 \u2025 * Sending important information in clear text (CWE-319) - CVE-2020-25178 \u2025 * DLL File search path is not properly controlled (CWE-427) - CVE-2020-25182 \u2025 * Use of hard-coded encryption key (CWE-321) - CVE-2020-25180The expected impact depends on each vulnerability, but it may be affected as follows. * Arbitrary code executed by a remote third party - CVE-2020-25176 \u2025 * Passwords and information stolen by local users - CVE-2020-25184 \u2025 * Files are uploaded, read and deleted by a remote third party - CVE-2020-25178 \u2025 * ISaGRAF Runtime But Microsoft Windows Any code executed by a local third party when running on - CVE-2020-25182 \u2025 * Information stolen by a remote third party - CVE-2020-25180. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25184"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "VULHUB",
"id": "VHN-179137"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-25184",
"trust": 2.5
},
{
"db": "ICS CERT",
"id": "ICSA-20-280-01",
"trust": 2.5
},
{
"db": "SCHNEIDER",
"id": "SEVD-2021-159-04",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90811375",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882",
"trust": 0.8
},
{
"db": "CS-HELP",
"id": "SB2021041363",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021120106",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021060920",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2163",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202106-526",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-179137",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179137"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25184"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-526"
}
]
},
"id": "VAR-202106-1999",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-179137"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:05:30.507000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Xylem\u00a0Product\u00a0Security\u00a0Advisory",
"trust": 0.8,
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
},
{
"title": "Rockwell Automation ISaGRAF Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=153706"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-526"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-522",
"trust": 1.1
},
{
"problemtype": "Relative path traversal (CWE-23) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Plaintext storage of credentials (CWE-256) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Sending important information in clear text (CWE-319) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use of hard-coded encryption key (CWE-321) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Uncontrolled search path elements (CWE-427) [IPA Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179137"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25184"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://download.schneider-electric.com/files?p_doc_ref=sevd-2021-159-04"
},
{
"trust": 1.7,
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
},
{
"trust": 1.7,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"
},
{
"trust": 1.7,
"url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"
},
{
"trust": 1.4,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-280-01"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu90811375"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2163"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021060920"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021120106"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2020-25184/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179137"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25184"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-526"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-179137"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25184"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-526"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-18T00:00:00",
"db": "VULHUB",
"id": "VHN-179137"
},
{
"date": "2021-06-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"date": "2022-03-18T18:15:09.300000",
"db": "NVD",
"id": "CVE-2020-25184"
},
{
"date": "2021-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2021-06-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-526"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-10-21T00:00:00",
"db": "VULHUB",
"id": "VHN-179137"
},
{
"date": "2021-06-21T08:28:00",
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"date": "2022-10-21T18:55:28.467000",
"db": "NVD",
"id": "CVE-2020-25184"
},
{
"date": "2021-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2022-04-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-526"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-526"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Rockwell\u00a0Automation\u00a0 Made \u00a0ISaGRAF5\u00a0Runtime\u00a0 Multiple vulnerabilities in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-526"
}
],
"trust": 1.2
}
}
VAR-202106-1938
Vulnerability from variot - Updated: 2023-12-18 10:58Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft Windows systems. Rockwell Automation Provided by the company ISaGRAF5 Runtime The following multiple vulnerabilities exist in. * Relative path traversal (CWE-23) - CVE-2020-25176 ‥ * Plaintext storage of credentials (CWE-256) - CVE-2020-25184 ‥ * Sending important information in clear text (CWE-319) - CVE-2020-25178 ‥ * DLL File search path is not properly controlled (CWE-427) - CVE-2020-25182 ‥ * Use of hard-coded encryption key (CWE-321) - CVE-2020-25180The expected impact depends on each vulnerability, but it may be affected as follows. * Arbitrary code executed by a remote third party - CVE-2020-25176 ‥ * Passwords and information stolen by local users - CVE-2020-25184 ‥ * Files are uploaded, read and deleted by a remote third party - CVE-2020-25178 ‥ * ISaGRAF Runtime But Microsoft Windows Any code executed by a local third party when running on - CVE-2020-25182 ‥ * Information stolen by a remote third party - CVE-2020-25180. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202106-1938",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "isagraf free runtime",
"scope": "lte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.6.8"
},
{
"model": "aadvance controller",
"scope": "lte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "1.40"
},
{
"model": "micro820",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "scd2200",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "10024"
},
{
"model": "isagraf runtime",
"scope": "lt",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.0"
},
{
"model": "micro850",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "5.2"
},
{
"model": "easergy t300",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "2.7.1"
},
{
"model": "micro830",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "isagraf runtime",
"scope": "gte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "5.0"
},
{
"model": "easergy c5",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "1.1.0"
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.1"
},
{
"model": "micro810",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "saitel dr",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "11.06.12"
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.3"
},
{
"model": "micro870",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "5.1"
},
{
"model": "saitel dp",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "11.06.21"
},
{
"model": "epas gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.4"
},
{
"model": "multismart",
"scope": "lt",
"trust": 1.0,
"vendor": "xylem",
"version": "3.2.0"
},
{
"model": "micom c264",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "d6.1"
},
{
"model": "multismart gen-1",
"scope": null,
"trust": 0.8,
"vendor": "xylem",
"version": null
},
{
"model": "alspa s6 mfc3000",
"scope": null,
"trust": 0.8,
"vendor": "ge steam power",
"version": null
},
{
"model": "aadvance controller",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "micro800",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "alspa s6 mfc1000",
"scope": null,
"trust": 0.8,
"vendor": "ge steam power",
"version": null
},
{
"model": "multismart gen-2",
"scope": null,
"trust": 0.8,
"vendor": "xylem",
"version": null
},
{
"model": "isagraf free runtime",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "isagraf runtime",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25182"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.7.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.1.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "d6.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.06.21",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.06.12",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10024",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.40",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*",
"cpe_name": [],
"versionEndIncluding": "6.6.8",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:windows:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25182"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kaspersky reported these vulnerabilities to Rockwell Automation.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-523"
}
],
"trust": 0.6
},
"cve": "CVE-2020-25182",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "VHN-179135",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 0.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "IPA",
"availabilityImpact": "High",
"baseScore": 6.7,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2021-001882",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "High",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-25182",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2020-25182",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "IPA",
"id": "JVNDB-2021-001882",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202106-523",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-179135",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179135"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25182"
},
{
"db": "NVD",
"id": "CVE-2020-25182"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-523"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft Windows systems. Rockwell Automation Provided by the company ISaGRAF5 Runtime The following multiple vulnerabilities exist in. * Relative path traversal (CWE-23) - CVE-2020-25176 \u2025 * Plaintext storage of credentials (CWE-256) - CVE-2020-25184 \u2025 * Sending important information in clear text (CWE-319) - CVE-2020-25178 \u2025 * DLL File search path is not properly controlled (CWE-427) - CVE-2020-25182 \u2025 * Use of hard-coded encryption key (CWE-321) - CVE-2020-25180The expected impact depends on each vulnerability, but it may be affected as follows. * Arbitrary code executed by a remote third party - CVE-2020-25176 \u2025 * Passwords and information stolen by local users - CVE-2020-25184 \u2025 * Files are uploaded, read and deleted by a remote third party - CVE-2020-25178 \u2025 * ISaGRAF Runtime But Microsoft Windows Any code executed by a local third party when running on - CVE-2020-25182 \u2025 * Information stolen by a remote third party - CVE-2020-25180. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25182"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "VULHUB",
"id": "VHN-179135"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-25182",
"trust": 2.5
},
{
"db": "ICS CERT",
"id": "ICSA-20-280-01",
"trust": 2.5
},
{
"db": "SCHNEIDER",
"id": "SEVD-2021-159-04",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90811375",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882",
"trust": 0.8
},
{
"db": "CS-HELP",
"id": "SB2021041363",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2163",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021060920",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202106-523",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-179135",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179135"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25182"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-523"
}
]
},
"id": "VAR-202106-1938",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-179135"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T10:58:32.123000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Xylem\u00a0Product\u00a0Security\u00a0Advisory",
"trust": 0.8,
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
},
{
"title": "Rockwell Automation ISaGRAF Fixes for code issue vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=154648"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-523"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-427",
"trust": 1.1
},
{
"problemtype": "Relative path traversal (CWE-23) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Plaintext storage of credentials (CWE-256) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Sending important information in clear text (CWE-319) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use of hard-coded encryption key (CWE-321) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Uncontrolled search path elements (CWE-427) [IPA Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179135"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25182"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://download.schneider-electric.com/files?p_doc_ref=sevd-2021-159-04"
},
{
"trust": 1.7,
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
},
{
"trust": 1.7,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"
},
{
"trust": 1.7,
"url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"
},
{
"trust": 1.4,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-280-01"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu90811375"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2163"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021060920"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2020-25182/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179135"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25182"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-523"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-179135"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25182"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-523"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-18T00:00:00",
"db": "VULHUB",
"id": "VHN-179135"
},
{
"date": "2021-06-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"date": "2022-03-18T18:15:09.243000",
"db": "NVD",
"id": "CVE-2020-25182"
},
{
"date": "2021-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2021-06-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-523"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-04-05T00:00:00",
"db": "VULHUB",
"id": "VHN-179135"
},
{
"date": "2021-06-21T08:28:00",
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"date": "2022-04-05T13:36:23.510000",
"db": "NVD",
"id": "CVE-2020-25182"
},
{
"date": "2021-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2022-04-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-523"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-523"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Rockwell\u00a0Automation\u00a0 Made \u00a0ISaGRAF5\u00a0Runtime\u00a0 Multiple vulnerabilities in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
}
],
"trust": 0.6
}
}
VAR-202106-1997
Vulnerability from variot - Updated: 2023-12-18 10:50Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device. Rockwell Automation Provided by the company ISaGRAF5 Runtime The following multiple vulnerabilities exist in. * Relative path traversal (CWE-23) - CVE-2020-25176 ‥ * Plaintext storage of credentials (CWE-256) - CVE-2020-25184 ‥ * Sending important information in clear text (CWE-319) - CVE-2020-25178 ‥ * DLL File search path is not properly controlled (CWE-427) - CVE-2020-25182 ‥ * Use of hard-coded encryption key (CWE-321) - CVE-2020-25180The expected impact depends on each vulnerability, but it may be affected as follows. * Arbitrary code executed by a remote third party - CVE-2020-25176 ‥ * Passwords and information stolen by local users - CVE-2020-25184 ‥ * Files are uploaded, read and deleted by a remote third party - CVE-2020-25178 ‥ * ISaGRAF Runtime But Microsoft Windows Any code executed by a local third party when running on - CVE-2020-25182 ‥ * Information stolen by a remote third party - CVE-2020-25180. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Rockwell Automation ISaGRAF is an automation software technology developed by Rockwell Automation in the United States for creating integrated automation solutions. It is designed to be scalable and portable, suitable for developing small controllers and large distributed automation systems
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202106-1997",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "isagraf free runtime",
"scope": "lte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.6.8"
},
{
"model": "aadvance controller",
"scope": "lte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "1.40"
},
{
"model": "micro820",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "scd2200",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "10024"
},
{
"model": "isagraf runtime",
"scope": "lt",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "6.0"
},
{
"model": "micro850",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "5.2"
},
{
"model": "easergy t300",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "2.7.1"
},
{
"model": "isagraf runtime",
"scope": "gte",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": "5.0"
},
{
"model": "micro830",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "easergy c5",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "1.1.0"
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.1"
},
{
"model": "micro810",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "saitel dr",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "11.06.12"
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.3"
},
{
"model": "micro870",
"scope": "eq",
"trust": 1.0,
"vendor": "rockwellautomation",
"version": null
},
{
"model": "pacis gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "5.1"
},
{
"model": "saitel dp",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "11.06.21"
},
{
"model": "epas gtw",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "6.4"
},
{
"model": "multismart",
"scope": "lt",
"trust": 1.0,
"vendor": "xylem",
"version": "3.2.0"
},
{
"model": "micom c264",
"scope": "lt",
"trust": 1.0,
"vendor": "schneider electric",
"version": "d6.1"
},
{
"model": "multismart gen-1",
"scope": null,
"trust": 0.8,
"vendor": "xylem",
"version": null
},
{
"model": "alspa s6 mfc3000",
"scope": null,
"trust": 0.8,
"vendor": "ge steam power",
"version": null
},
{
"model": "aadvance controller",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "micro800",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "alspa s6 mfc1000",
"scope": null,
"trust": 0.8,
"vendor": "ge steam power",
"version": null
},
{
"model": "multismart gen-2",
"scope": null,
"trust": 0.8,
"vendor": "xylem",
"version": null
},
{
"model": "isagraf free runtime",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
},
{
"model": "isagraf runtime",
"scope": null,
"trust": 0.8,
"vendor": "rockwell automation",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25180"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.7.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.1.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "d6.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.06.21",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.06.12",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "10024",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.40",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*",
"cpe_name": [],
"versionEndIncluding": "6.6.8",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.2.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25180"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kaspersky reported these vulnerabilities to Rockwell Automation.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-529"
}
],
"trust": 0.6
},
"cve": "CVE-2020-25180",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-179133",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "ics-cert@hq.dhs.gov",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 6.8,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2021-001882",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N \t",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-25180",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2020-25180",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "IPA",
"id": "JVNDB-2021-001882",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202106-529",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-179133",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179133"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25180"
},
{
"db": "NVD",
"id": "CVE-2020-25180"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-529"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device. Rockwell Automation Provided by the company ISaGRAF5 Runtime The following multiple vulnerabilities exist in. * Relative path traversal (CWE-23) - CVE-2020-25176 \u2025 * Plaintext storage of credentials (CWE-256) - CVE-2020-25184 \u2025 * Sending important information in clear text (CWE-319) - CVE-2020-25178 \u2025 * DLL File search path is not properly controlled (CWE-427) - CVE-2020-25182 \u2025 * Use of hard-coded encryption key (CWE-321) - CVE-2020-25180The expected impact depends on each vulnerability, but it may be affected as follows. * Arbitrary code executed by a remote third party - CVE-2020-25176 \u2025 * Passwords and information stolen by local users - CVE-2020-25184 \u2025 * Files are uploaded, read and deleted by a remote third party - CVE-2020-25178 \u2025 * ISaGRAF Runtime But Microsoft Windows Any code executed by a local third party when running on - CVE-2020-25182 \u2025 * Information stolen by a remote third party - CVE-2020-25180. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Rockwell Automation ISaGRAF is an automation software technology developed by Rockwell Automation in the United States for creating integrated automation solutions. It is designed to be scalable and portable, suitable for developing small controllers and large distributed automation systems",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25180"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "VULHUB",
"id": "VHN-179133"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-25180",
"trust": 2.5
},
{
"db": "ICS CERT",
"id": "ICSA-20-280-01",
"trust": 2.5
},
{
"db": "SCHNEIDER",
"id": "SEVD-2021-159-04",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90811375",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882",
"trust": 0.8
},
{
"db": "CS-HELP",
"id": "SB2021041363",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021120106",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021060920",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2163",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202106-529",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-179133",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179133"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25180"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-529"
}
]
},
"id": "VAR-202106-1997",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-179133"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T10:50:16.588000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Xylem\u00a0Product\u00a0Security\u00a0Advisory",
"trust": 0.8,
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
},
{
"title": "Rockwell Automation ISaGRAF Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=153709"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-529"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-798",
"trust": 1.1
},
{
"problemtype": "Relative path traversal (CWE-23) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Plaintext storage of credentials (CWE-256) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Sending important information in clear text (CWE-319) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Use of hard-coded encryption key (CWE-321) [IPA Evaluation ]",
"trust": 0.8
},
{
"problemtype": " Uncontrolled search path elements (CWE-427) [IPA Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179133"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25180"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://download.schneider-electric.com/files?p_doc_ref=sevd-2021-159-04"
},
{
"trust": 1.7,
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699"
},
{
"trust": 1.7,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01"
},
{
"trust": 1.7,
"url": "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"
},
{
"trust": 1.4,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-280-01"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu90811375"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2163"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021060920"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2020-25180/"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021120106"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-179133"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25180"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-529"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-179133"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"db": "NVD",
"id": "CVE-2020-25180"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-529"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-18T00:00:00",
"db": "VULHUB",
"id": "VHN-179133"
},
{
"date": "2021-06-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"date": "2022-03-18T18:15:09.187000",
"db": "NVD",
"id": "CVE-2020-25180"
},
{
"date": "2021-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2021-06-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-529"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-04-04T00:00:00",
"db": "VULHUB",
"id": "VHN-179133"
},
{
"date": "2021-06-21T08:28:00",
"db": "JVNDB",
"id": "JVNDB-2021-001882"
},
{
"date": "2022-04-04T20:59:49.830000",
"db": "NVD",
"id": "CVE-2020-25180"
},
{
"date": "2021-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2022-04-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-529"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-529"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Rockwell\u00a0Automation\u00a0 Made \u00a0ISaGRAF5\u00a0Runtime\u00a0 Multiple vulnerabilities in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-001882"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
}
],
"trust": 0.6
}
}