{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-10T20:00:12.824","vulnerabilities":[{"cve":{"id":"CVE-2020-25176","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2022-03-18T18:15:09.060","lastModified":"2024-11-21T05:17:33.640","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution."},{"lang":"es","value":"Algunos comandos usados por el protocolo de Rockwell Automation ISaGRAF Runtime Versiones 4.x y 5.x eXchange Layer (IXL) llevan a cabo varias operaciones de archivo en el sistema de archivos. Dado que el parámetro que apunta al nombre del archivo no es comprobado en busca de caracteres reservados, es posible que un atacante remoto no autenticado recorra el directorio de una aplicación, lo que podría conllevar a una ejecución remota de código"}],"metrics":{"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-23"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:easergy_t300_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"2.7.1","matchCriteriaId":"E07AFED6-47CC-4A19-80DB-C537F4F07736"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:easergy_t300:-:*:*:*:*:*:*:*","matchCriteriaId":"45E6C3FA-001D-449A-A512-327FA0C9AC5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:easergy_c5_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.1.0","matchCriteriaId":"01E1BC45-FFB3-4D5A-BA09-BA56A492E784"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:easergy_c5:-:*:*:*:*:*:*:*","matchCriteriaId":"A2EF5114-E9EB-47E1-A388-0963337906C6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:micom_c264_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"d6.1","matchCriteriaId":"17A5F6A2-32F6-4CDA-B2FE-EAA86B6BC43F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:micom_c264:-:*:*:*:*:*:*:*","matchCriteriaId":"A4F6A5C4-E0B2-44F2-823F-9E9C59E7B1F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.1:*:*:*:*:windows:*:*","matchCriteriaId":"716B1453-6203-4E7C-947D-71A031F79B3E"},{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:pacis_gtw_firmware:5.2:*:*:*:*:windows:*:*","matchCriteriaId":"05986825-76CD-486D-941A-E69A084F2A3E"},{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.1:*:*:*:*:windows:*:*","matchCriteriaId":"F59F968F-E480-4262-9754-BBC180E1AE24"},{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:linux:*:*","matchCriteriaId":"514C1283-E965-4543-991B-24FD5AA07D58"},{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:pacis_gtw_firmware:6.3:*:*:*:*:windows:*:*","matchCriteriaId":"E3FDEC1C-930B-4B8D-A67A-1D46E2069A9B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:pacis_gtw:-:*:*:*:*:*:*:*","matchCriteriaId":"2240540D-73BB-47F1-A8CA-844DC6B00CE6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:saitel_dp_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"11.06.21","matchCriteriaId":"AC5965EE-EB40-443A-BFDE-E97BD1C0F4E3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:saitel_dp:-:*:*:*:*:*:*:*","matchCriteriaId":"E6D73382-1957-4CC7-953F-D57C005D63B0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:linux:*:*","matchCriteriaId":"6011641C-4319-4FC3-9EB4-F8537A2C50C9"},{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:epas_gtw_firmware:6.4:*:*:*:*:windows:*:*","matchCriteriaId":"A08C5894-6894-44B7-809C-542732BDE84B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:epas_gtw:-:*:*:*:*:*:*:*","matchCriteriaId":"4034AC56-BEC6-49EA-9C42-6D0AE360B7E1"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:saitel_dr_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"11.06.12","matchCriteriaId":"47A24A85-B912-4A15-AB2E-BF2EE739686F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:saitel_dr:-:*:*:*:*:*:*:*","matchCriteriaId":"E65C2AD5-0079-47AA-82F3-F9335DCFA0AA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:schneider-electric:scd2200_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"10024","matchCriteriaId":"6D556CAB-DA72-4978-BB45-5B2834C03061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:cp-3:-:*:*:*:*:*:*:*","matchCriteriaId":"7C543522-AD89-48DD-90BB-47D686E93ADF"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:mc-31:-:*:*:*:*:*:*:*","matchCriteriaId":"53C778F7-64DA-4FD4-BB7F-2E5BB8BDB774"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rockwellautomation:aadvance_controller:*:*:*:*:*:*:*:*","versionEndIncluding":"1.40","matchCriteriaId":"81F6F3FE-B508-4482-B832-992242F80D30"},{"vulnerable":true,"criteria":"cpe:2.3:a:rockwellautomation:isagraf_free_runtime:*:*:*:*:*:isagraf6_workbench:*:*","versionEndIncluding":"6.6.8","matchCriteriaId":"6B1C6230-85E9-4053-90EB-715919960F80"},{"vulnerable":true,"criteria":"cpe:2.3:a:rockwellautomation:isagraf_runtime:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.0","matchCriteriaId":"7B3B8CEE-D6C8-44D9-B601-F862185A6075"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:rockwellautomation:micro810_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5798DD01-C49B-4DA9-9E83-2C875A345A1A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:rockwellautomation:micro810:-:*:*:*:*:*:*:*","matchCriteriaId":"7CBC81B7-2559-46EB-A129-0456442C06D9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:rockwellautomation:micro820_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9FCA425-ACD4-4F6F-97CF-3B05A1C003E8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:rockwellautomation:micro820:-:*:*:*:*:*:*:*","matchCriteriaId":"7635A8EC-2D15-4BC6-938C-DC30AA21BEAB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:rockwellautomation:micro830_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9BFBB963-DD14-405D-B9ED-6277354A5A57"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:rockwellautomation:micro830:-:*:*:*:*:*:*:*","matchCriteriaId":"8EE48F31-B3FE-463F-B366-05116E4093DE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:rockwellautomation:micro850_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8EEDFAA2-4E38-457E-9E50-802984D1C0E6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:rockwellautomation:micro850:-:*:*:*:*:*:*:*","matchCriteriaId":"B8BD0226-7434-4849-AD0D-35AB5A793F25"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:rockwellautomation:micro870_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CAFD020B-28D9-4EC5-A282-4D42DC02A34C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:rockwellautomation:micro870:-:*:*:*:*:*:*:*","matchCriteriaId":"09DEF107-D1C4-456A-BB02-1731498568FD"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:xylem:multismart_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.0","matchCriteriaId":"F64B0A94-A252-4052-A2C2-CD2374E3CCF2"}]}]}],"references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04","source":"ics-cert@hq.dhs.gov","tags":["Mitigation","Vendor Advisory"]},{"url":"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699","source":"ics-cert@hq.dhs.gov","tags":["Permissions Required"]},{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01","source":"ics-cert@hq.dhs.gov","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf","source":"ics-cert@hq.dhs.gov","tags":["Third Party Advisory"]},{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Vendor Advisory"]},{"url":"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required"]},{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}