Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Severity
500636	Rockwell Automation ISaGRAF5 Runtime Plaintext Storage of a Password (CVE-2020-25184)	Tenable OT Security	Tenable.ot	medium
500635	Schneider Electric Plaintext Storage of a Password in embedded Rockwell Automation ISaGRAF5 Runtime (CVE-2020-25184)	Tenable OT Security	Tenable.ot	medium

Detections

Analytics

CVE-2020-25184

medium

Tenable Plugins

medium

medium