CVE-2020-25180 : What You Need to Know

Rockwell Automation ISaGRAF5 Runtime includes a vulnerability that allows remote attackers to disclose information on the device. The issue arises from the use of a hard-coded cryptographic key for password encryption.

Understanding CVE-2020-25180

This CVE involves a security flaw in Rockwell Automation ISaGRAF5 Runtime versions 4.x and 5.x, impacting the encryption of passwords.

What is CVE-2020-25180?

Rockwell Automation ISaGRAF5 Runtime versions 4.x and 5.x utilize a fixed key value for encrypting passwords, making it susceptible to unauthorized access and potential information disclosure.

The Impact of CVE-2020-25180

The vulnerability poses a medium severity risk with high confidentiality impact, allowing remote, unauthenticated attackers to exploit the hard-coded cryptographic key and potentially access sensitive information on the device.

Technical Details of CVE-2020-25180

The technical aspects of the CVE provide insight into the vulnerability's description, affected systems, and the exploitation mechanism.

Vulnerability Description

The flaw in ISaGRAF5 Runtime versions 4.x and 5.x stems from the use of a fixed key value in the encryption process, enabling attackers to pass their encrypted password and potentially gain unauthorized access.

Affected Systems and Versions

Product: ISaGRAF Runtime
Vendor: Rockwell Automation
Versions Affected: 4.x, 5.x

Exploitation Mechanism

Attack Complexity: High
Attack Vector: Network
Confidentiality Impact: High
User Interaction: Required
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Mitigation and Prevention

Effective mitigation strategies and preventive measures are crucial to addressing CVE-2020-25180.

Immediate Steps to Take

Update to ISaGRAF Runtime 5 Version 5.72.00
Restrict or block access on TCP 1131 and TCP 1132
Follow the least-privilege user principle

Long-Term Security Practices

Implement proper network segmentation and security controls
Minimize network exposure for control system devices
Utilize firewalls to isolate control systems
Refer to industry best practices for network segmentation
Deploy network infrastructure controls like firewalls and VPN

Patching and Updates

Evaluate and apply provided mitigations for affected versions
Combine guidance with general security practices for a comprehensive defense strategy
Seek further information from Rockwell Automation, Schneider Electric, Xylem, or GE for additional product-specific mitigation advice