CVE-2020-25184

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGRAF Runtime reads the file and saves the data in a variable without any additional modification. A local, unauthenticated attacker could compromise the user passwords, resulting in information disclosure.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-256 CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Mar 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-251858.8The affected product is vulnerable to five post-authentication buffer overflows, which may allow a logged in user to remotely execute arbitr CVE-2020-251867.5An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, which may allow file d CVE-2020-251879.8Medtronic MyCareLink Smart 25000 is vulnerable when an authenticated attacker runs a debug command, which can be sent to the patient read CVE-2020-251887.8An attacker who convinces a valid user to open a specially crafted project file to exploit could execute code under the privileges of the ap CVE-2020-251899.8The affected product is vulnerable to three stack-based buffer overflows, which may allow an unauthenticated attacker to remotely execute ar CVE-2020-25194.3Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected a CVE-2020-251909.8The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party servic CVE-2020-251917.5Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a functi CVE-2020-251925.3The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without prope CVE-2020-251935.3By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08 CVE-2020-251948.8The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an atta CVE-2020-251957.5The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when