9.1
Critique
CVE-2020-25176 Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform…
Description
Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ISaGRAF Runtime | 5.x | Pas de correctif indiqué |
| ISaGRAF Runtime | 4.x | Pas de correctif indiqué |
Autres CVE de ISaGRAF Runtime
Les 5 CVE de ISaGRAF Runtime →
CVE-2020-25180
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is…
5.3
Moyenne
CVE-2020-25184
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the…
7.8
Élevée
CVE-2020-25182
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries
6.7
Moyenne
CVE-2020-25178
ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP
7.5
Élevée