Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal

published 2022-03-18 4 y ago modified 2026-06-17 4 mo ago also EUVD-2020-17867

cvss: 9.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 6.4%; EPSS 6.4% chance of exploitation in 30 days, percentile 93%
public exploits: 0; none known

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.

Patch / fix

fixed in 4

rockwellautomation isagraf_runtime 6.0
schneider-electric easergy_c5_firmware 1.1.0
schneider-electric micom_c264_firmware d6.1
xylem multismart_firmware 3.2.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-20-280-01 updated 2021-06-17 cvss 9.1

Rockwell Automation ISaGRAF5 Runtime (Update A)

Rockwell Automation AADvance Controller <= 1.40 Rockwell Automation GE Steam Power's ALSPA S6 MFC3000 and MFC1000 Rockwell Automation ISaGRAF Free Runtime in ISaGRAF6 Workbench <= 6.6.8 Rockwell Automation Micro800 family Rockwell Automation MultiSmart Gen-1 devices and MultiSmart Gen-2 < 3.2.0
affected: mitigation “Reference Rockwell Automation.” compatibility.rockwellautomation.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 18 mo ago (2025-04-16)

Exploit prediction

6.42% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

Rockwell Automation ISaGRAF Runtime

Classification

Weakness

CWE-23 Relative Path Traversal
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

download.schneider-electric.com /files?p_Doc_Ref=SEVD-2021-159-04
mitigation, vendor-advisory
cisa.gov /uscert/ics/advisories/icsa-20-280-01
third-party-advisory, us-government-resource
rockwellautomation.custhelp.com /app/answers/answer_view/a_id/1131699
permissions-required
xylem.com /siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf
third-party-advisory

Sources

CVE List CVE-2020-25176
NVD CVE-2020-25176

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary