CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
15.6%
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft Windows systems.
This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
#%NASL_MIN_LEVEL 70300
##
# (C) Tenable, Inc.
##
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(500648);
script_version("1.7");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");
script_cve_id("CVE-2020-25182");
script_xref(name:"ICSA", value:"20-280-01");
script_name(english:"Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element (CVE-2020-25182)");
script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
script_set_attribute(attribute:"description", value:
"Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for
and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic
libraries could allow a local, unauthenticated attacker to execute
arbitrary code. This vulnerability only affects ISaGRAF Runtime when
running on Microsoft Windows systems.
This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01");
# https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?92e65ec9");
# https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4dce6d5b");
# https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?659f30cf");
# https://www.rockwellautomation.com/en-us/support/advisory.PN1567.html
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b80e95da");
script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.
Rockwell Automation recommends users update to ISaGRAF Runtime 5 Version 5.72.00. End users are encouraged to restrict
or block access on TCP 1131 and TCP 1132 from outside the industrial control system. Confirm the least-privilege user
principle is followed and user/service account access to Runtime's folder location is granted with a minimum amount of
rights needed.
Rockwell Automation recommends users of affected versions evaluate the mitigations provided and apply the appropriate
mitigations to deployed products. Users are encouraged to combine this guidance with the general security guidelines for
a comprehensive defense-in-depth strategy.
To reduce risk, Rockwell Automation recommends users:
- Employ proper network segmentation and security controls.
- Minimize network exposure for all control system devices.
- Locate control systems behind firewalls.
- Isolate control systems from other networks when possible.
- Refer to the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide for best practices deploying network
segmentation and broader defense-in-depth strategies.
- Consider using proper network infrastructure controls, such as firewalls, UTM devices, VPN, or other security
appliances.
- Ensure the least-privilege user principle is followed, and user/service account access to RuntimeΓ’ΒΒs folder location is
granted with a minimum amount of rights, as needed.
Please see publications from Rockwell Automation and Schneider Electric, Xylem, or contact GE for further information
about how to mitigate these vulnerabilities in additional affected products.");
script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-25182");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_cwe_id(427);
script_set_attribute(attribute:"vuln_publication_date", value:"2022/03/18");
script_set_attribute(attribute:"patch_publication_date", value:"2022/03/18");
script_set_attribute(attribute:"plugin_publication_date", value:"2022/04/28");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro810_firmware:-");
script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro820_firmware:-");
script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro830_firmware:-");
script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro850_firmware:-");
script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro870_firmware:-");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Tenable.ot");
script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("tenable_ot_api_integration.nasl");
script_require_keys("Tenable.ot/Rockwell");
exit(0);
}
include('tenable_ot_cve_funcs.inc');
get_kb_item_or_exit('Tenable.ot/Rockwell');
var asset = tenable_ot::assets::get(vendor:'Rockwell');
var vuln_cpes = {
"cpe:/o:rockwellautomation:micro810_firmware:-" :
{"family" : "Micro810"},
"cpe:/o:rockwellautomation:micro820_firmware:-" :
{"family" : "Micro820"},
"cpe:/o:rockwellautomation:micro830_firmware:-" :
{"family" : "Micro830"},
"cpe:/o:rockwellautomation:micro850_firmware:-" :
{"family" : "Micro850"},
"cpe:/o:rockwellautomation:micro870_firmware:-" :
{"family" : "Micro870"}
};
tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
15.6%