Log in Start free

Vulnerability · Published Mar 18, 2022 · Assigned by icscert

CVE-2020-25180Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key

Medium 5.3

In plain English

A medium-severity security flaw in ISaGRAF Runtime from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.2%top 32.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device.

Affected products (as reported)

VendorProductVersions
Rockwell Automation ISaGRAF Runtime 4.x5.x

Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References