Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application's directory, which could lead to remote code execution.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Severity
500638	Schneider Electric Relative Path Traversal in embedded Rockwell Automation ISaGRAF5 Runtime (CVE-2020-25176)	Tenable OT Security	Tenable.ot	critical
500637	Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal (CVE-2020-25176)	Tenable OT Security	Tenable.ot	critical

Detections

Analytics

CVE-2020-25176

critical

Tenable Plugins

critical

critical