CVE-2020-25184 — Plaintext Storage of a Password in Isagraf Runtime

CWE-256 — Plaintext Storage of a PasswordCWE-522 — Insufficiently Protected Credentials3 documents3 sources
Severity
5.5MEDIUMNVD
CNA7.8
EPSS
0.0%
top 90.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
Rockwellautomation Isagraf RuntimeSchneider-electric Easergy C5 FirmwareSchneider-electric Micom C264 Firmware+10 more
Timeline
PublishedMar 18
Latest updateMar 19

Description

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages13 packages

🔴Vulnerability Details

2
GHSA
GHSA-3f6m-7jq2-3x7m: Rockwell Automation ISaGRAF Runtime Versions 4↗2022-03-19
▶
CVEList
Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials↗2022-03-18
▶
CVE-2020-25184 — Plaintext Storage of a Password | cvebase