CWE
427
Advisory Published
Updated

CVE-2020-25182: Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element

First published: Fri Mar 18 2022(Updated: )

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft Windows systems.

Credit: ics-cert@hq.dhs.gov

Affected SoftwareAffected VersionHow to fix
Schneider-electric Easergy T300 Firmware<=2.7.1
Schneider-electric Easergy T300
Schneider-electric Easergy C5 Firmware<1.1.0
Schneider-electric Easergy C5
Schneider-electric Micom C264 Firmware<d6.1
Schneider-electric Micom C264
Schneider-electric Pacis Gtw Firmware=5.1
Schneider-electric Pacis Gtw Firmware=5.2
Schneider-electric Pacis Gtw Firmware=6.1
Schneider-electric Pacis Gtw Firmware=6.3
Schneider-electric Pacis Gtw Firmware=6.3
Schneider-electric Pacis Gtw
Schneider-electric Saitel Dp Firmware<=11.06.21
Schneider-electric Saitel Dp
Schneider-electric Epas Gtw Firmware=6.4
Schneider-electric Epas Gtw Firmware=6.4
Schneider-electric Epas Gtw
Schneider-electric Saitel Dr Firmware<=11.06.12
Schneider-electric Saitel Dr
Schneider-electric Scd2200 Firmware<=10024
Schneider-electric Cp-3
Schneider-electric Mc-31
Rockwellautomation Aadvance Controller<=1.40
Rockwellautomation Isagraf Free Runtime<=6.6.8
Rockwellautomation Micro810 Firmware
Rockwellautomation Micro810
Rockwellautomation Micro820 Firmware
Rockwellautomation Micro820
Rockwellautomation Micro830 Firmware
Rockwellautomation Micro830
Rockwellautomation Micro850 Firmware
Rockwellautomation Micro850
Rockwellautomation Micro870 Firmware
Rockwellautomation Micro870
Xylem Multismart Firmware<3.2.0
Rockwellautomation Isagraf Runtime>=5.0<6.0
Rockwell Automation AADvance Controller version 1.40 and earlier
Rockwell Automation ISaGRAF Free Runtime in ISaGRAF6 Workbench Version 6.6.8 and earlier
Rockwell Automation Micro800 family, all versions

Remedy

Rockwell Automation recommends users update to ISaGRAF Runtime 5 Version 5.72.00. End users are encouraged to restrict or block access on TCP 1131 and TCP 1132 from outside the industrial control system. Confirm the least-privilege user principle is followed and user/service account access to Runtime's folder location is granted with a minimum amount of rights needed. Rockwell Automation recommends users of affected versions evaluate the mitigations provided and apply the appropriate mitigations to deployed products. Users are encouraged to combine this guidance with the general security guidelines for a comprehensive defense-in-depth strategy. To reduce risk, Rockwell Automation recommends users: Employ proper network segmentation and security controls. Minimize network exposure for all control system devices. Locate control systems behind firewalls. Isolate control systems from other networks when possible. Refer to the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide for best practices deploying network segmentation and broader defense-in-depth strategies. Consider using proper network infrastructure controls, such as firewalls, UTM devices, VPN, or other security appliances. Ensure the least-privilege user principle is followed, and user/service account access to Runtime’s folder location is granted with a minimum amount of rights, as needed. Please see publications from Rockwell Automation and Schneider Electric, Xylem, or contact GE for further information about how to mitigate these vulnerabilities in additional affected products.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Parent vulnerabilities

(Appears in the following advisories)

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203