CVE-2020-25184

HIGH

Schneider-electric Easergy T300 Firmware - Information Disclosure

Title source: rule

Description

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.

References (4)

[Third Party Advisory, US Government Resource] https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01

[Permissions Required] https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699

[Vendor Advisory] https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04

[Vendor Advisory] https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf

Scores

CVSS v3 7.8

EPSS 0.0003

EPSS Percentile 9.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-522 CWE-256

Status published

Products (20)

rockwellautomation/aadvance_controller < 1.40

rockwellautomation/isagraf_free_runtime < 6.6.8

rockwellautomation/isagraf_runtime 5.0 - 6.0

rockwellautomation/micro810_firmware

rockwellautomation/micro820_firmware

rockwellautomation/micro830_firmware

rockwellautomation/micro850_firmware

rockwellautomation/micro870_firmware

schneider-electric/easergy_c5_firmware < 1.1.0

schneider-electric/easergy_t300_firmware < 2.7.1

... and 10 more

Published Mar 18, 2022

Tracked Since Feb 18, 2026