Description
ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Rockwell Automation ISaGRAF Runtime
4.xaffected5.xaffected
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01 ↗
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699 ↗
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04 ↗
- https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf ↗