Multiple vulnerabilities in Rockwell Automation ISaGRAF5 Runtime

1) Path traversal

EUVDB-ID: #VU53972

Risk: Low

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-25176

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the ISaGRAF eXchange Layer (IXL) protocol. A remote administrator can send a specially crafted HTTP request and read arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

AADvance Controller: 1.40

ISaGRAF Free Runtime in ISaGRAF6 Workbench: 6.6.8

Micro800: All versions

ISaGRAF Runtime: before 5.72.00

External links

http://ics-cert.us-cert.gov/advisories/icsa-20-280-01
http://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/07/13/klcert-20-022-rockwell-automation-isagraf-runtime-code-execution-due-to-relative-path-traversal

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cleartext storage of sensitive information

EUVDB-ID: #VU53974

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-25184

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a local user to gain access to other users' credentials.

The vulnerability exists due to the ISaGRAF Runtime stored credentials in plain text in a configuration file on the system. A local user can view contents of the configuration file and gain access to passwords for 3rd party integration.

Mitigation

Install update from vendor's website.

Vulnerable software versions

AADvance Controller: 1.40

ISaGRAF Free Runtime in ISaGRAF6 Workbench: 6.6.8

Micro800: All versions

ISaGRAF Runtime: before 5.72.00

External links

http://ics-cert.us-cert.gov/advisories/icsa-20-280-01
http://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/07/13/klcert-20-026-rockwell-automation-isagraf-runtime-information-disclosure-due-to-cleartext-storage-of-passwords-in-a-file-and-memory

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cleartext transmission of sensitive information

EUVDB-ID: #VU53975

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-25178

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information. A remote attacker can upload, read, and delete files.

Mitigation

Install update from vendor's website.

Vulnerable software versions

AADvance Controller: 1.40

ISaGRAF Free Runtime in ISaGRAF6 Workbench: 6.6.8

Micro800: All versions

ISaGRAF Runtime: before 5.72.00

External links

http://ics-cert.us-cert.gov/advisories/icsa-20-280-01
http://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/07/13/klcert-20-023-rockwell-automation-isagraf-runtime-information-disclosure-due-to-cleartext-transmission-of-information-over-ixl-protocol

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Insecure DLL loading

EUVDB-ID: #VU53977

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-25182

CWE-ID: CWE-427 - Uncontrolled Search Path Element

Exploit availability: No

Description

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner. A local administrator can execute arbitrary code on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

AADvance Controller: 1.40

ISaGRAF Free Runtime in ISaGRAF6 Workbench: 6.6.8

Micro800: All versions

ISaGRAF Runtime: before 5.72.00

External links

http://ics-cert.us-cert.gov/advisories/icsa-20-280-01
http://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/07/13/klcert-20-024-rockwell-automation-isagraf-runtime-code-execution-due-to-uncontrolled-search-path-element

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use of Hard-coded Cryptographic Key

EUVDB-ID: #VU53979

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-25180

CWE-ID: CWE-321 - Use of Hard-coded Cryptographic Key

Exploit availability: No

Description

The vulnerability allows a remote attacker to disclose sensitive information on the target system.

The vulnerability exists due to use of hard-coded cryptographic key issue. A remote attacker can pass their own encrypted password to the ISaGRAF 5 Runtime, and cause information disclosure on the device.

Mitigation

Install update from vendor's website.

Vulnerable software versions

AADvance Controller: 1.40

ISaGRAF Free Runtime in ISaGRAF6 Workbench: 6.6.8

Micro800: All versions

ISaGRAF Runtime: before 5.72.00

External links

http://ics-cert.us-cert.gov/advisories/icsa-20-280-01
http://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/07/13/klcert-20-025-rockwell-automation-isagraf-runtime-information-disclosure-due-to-hard-coded-cryptographic-key

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.