CVE-2020-25176

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23 CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-251778.8WECON PLC Editor Versions 1.3.8 and prior has a stack-based buffer overflow vulnerability has been identified that may allow arbitrary code CVE-2020-251788.8ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provi CVE-2020-251799.8GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network.CVE-2020-25187.5Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c CVE-2020-251806.5Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privil CVE-2020-251818.8WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary cod CVE-2020-251826.7Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic l CVE-2020-251838.8Medtronic MyCareLink Smart 25000 contains an authentication protocol vulnerability where the method used to authenticate between the MCL S CVE-2020-251845.5Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the exe CVE-2020-251858.8The affected product is vulnerable to five post-authentication buffer overflows, which may allow a logged in user to remotely execute arbitr CVE-2020-251867.5An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, which may allow file d CVE-2020-251879.8Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient read