CVE-2020-25182 Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element
Local attackers can execute arbitrary code via uncontrolled DLL loading in Rockwell Automation ISaGRAF Runtime on Windows.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-25182?
CVE-2020-25182 is a medium-severity vulnerability in Rockwell Automation ISaGRAF Runtime, published on 18 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft Windows systems.
Weakness: CWE-427
Which versions are affected by CVE-2020-25182?
It affects 17 products.
Products include Rockwellautomation Aadvance Controller, Rockwellautomation Isagraf Free Runtime, Rockwellautomation Isagraf Runtime, Rockwellautomation Micro810 Firmware, Rockwellautomation Micro820 Firmware, Rockwellautomation Micro830 Firmware and 11 more.
How do I fix CVE-2020-25182?
No fix has been published for CVE-2020-25182 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-25182 being exploited?
There is no known exploitation of CVE-2020-25182 in the wild and no public exploit code.
Other vulnerabilities in Rockwell Automation ISaGRAF Runtime
- CVE-2020-25176 Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal
- CVE-2020-25184 Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials
- CVE-2020-25178 Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Information
- CVE-2020-25180 Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key
Sources
Also known as GHSA-f6jg-3f64-ghp3.