CVE-2020-25184: rockwell automation isagraf runtime Plaintext Storage of a Password
Vulnerability summary
CVE-2020-25184 is a high (CVSS 7.8) Plaintext Storage of a Password vulnerability in rockwell automation isagraf runtime. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.9% of scored vulnerabilities.
Timeline
- 18-03-2022PublishedVulnerability first disclosed.
- 16-04-2025Last modifiedVulnerability information updated.
Description
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
0.00 pp
From 0.44% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-256Plaintext Storage of a PasswordThe product stores a password in plaintext within resources such as memory or files.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Rockwellautomation8 products
- aadvance_controller≤ 1.40
- isagraf_free_runtime≤ 6.6.8
- isagraf_runtime≥ 5.0, < 6.0
- micro810_firmwarena
- micro820_firmwarena
Schneider-electric8 products
- easergy_c5_firmware< 1.1.0
- easergy_t300_firmware≤ 2.7.1
- epas_gtw_firmware6.4
- micom_c264_firmware< d6.1
- pacis_gtw_firmware5.1 | 5.2 | 6.1 | 6.3
Rockwell automation1 product
- isagraf runtime≥ 4.0, < 5.0 | ≥ 5.0, < 6.0
Xylem1 product
- multismart_firmware< 3.2.0
4 vendors · 18 products
References
4 links
www.cisa.gov/uscert/ics/advisories/icsa-20-280-01X Refsource CONFIRMThird Party AdvisoryUS Government Resource- rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699X Refsource CONFIRMPermissions Required
- www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdfX Refsource CONFIRMVendor Advisory