CVE-2020-25184

HIGH

Schneider-electric Easergy T300 Firmware - Information Disclosure

Title source: rule

Description

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.

References (4)

[Vendor Advisory] https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04

[Permissions Required] https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699

[Third Party Advisory, US Government Resource] https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01

[Vendor Advisory] https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf

Scores

CVSS v3 7.8

EPSS 0.0003

EPSS Percentile 7.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-522 CWE-256

Status published

Affected Products (22)

schneider-electric/easergy_t300_firmware < 2.7.1

schneider-electric/easergy_c5_firmware < 1.1.0

schneider-electric/micom_c264_firmware < d6.1

schneider-electric/pacis_gtw_firmware

schneider-electric/saitel_dp_firmware < 11.06.21

schneider-electric/epas_gtw_firmware

schneider-electric/saitel_dr_firmware < 11.06.12

schneider-electric/scd2200_firmware < 10024

rockwellautomation/aadvance_controller < 1.40

rockwellautomation/isagraf_free_runtime < 6.6.8

... and 7 more

Timeline

Published Mar 18, 2022

Tracked Since Feb 18, 2026