{
    "id": "CVE-2020-25176",
    "published": "2022-03-18 18:15:09",
    "last_modified": "2026-06-17 03:06:31",
    "cvss_score": "9.1",
    "cvss_severity": "CRITICAL",
    "cvss_version": "3.1",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
    "cwe": "CWE-23",
    "description": "Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.",
    "epss_score": "0.06421",
    "epss_percentile": "0.93512",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 0,
    "updated_at": "2026-10-06 18:17:23",
    "priority": {
        "rank": 3,
        "label": "In your normal cycle",
        "why": "Critical by CVSS (9.1), but no sign of active exploitation."
    },
    "products": [
        {
            "vendor": "rockwellautomation",
            "product": "aadvance_controller"
        },
        {
            "vendor": "rockwellautomation",
            "product": "isagraf_free_runtime"
        },
        {
            "vendor": "rockwellautomation",
            "product": "isagraf_runtime"
        },
        {
            "vendor": "rockwellautomation",
            "product": "micro810"
        },
        {
            "vendor": "rockwellautomation",
            "product": "micro810_firmware"
        },
        {
            "vendor": "rockwellautomation",
            "product": "micro820"
        },
        {
            "vendor": "rockwellautomation",
            "product": "micro820_firmware"
        },
        {
            "vendor": "rockwellautomation",
            "product": "micro830"
        },
        {
            "vendor": "rockwellautomation",
            "product": "micro830_firmware"
        },
        {
            "vendor": "rockwellautomation",
            "product": "micro850"
        },
        {
            "vendor": "rockwellautomation",
            "product": "micro850_firmware"
        },
        {
            "vendor": "rockwellautomation",
            "product": "micro870"
        },
        {
            "vendor": "rockwellautomation",
            "product": "micro870_firmware"
        },
        {
            "vendor": "schneider-electric",
            "product": "cp-3"
        },
        {
            "vendor": "schneider-electric",
            "product": "easergy_c5"
        },
        {
            "vendor": "schneider-electric",
            "product": "easergy_c5_firmware"
        },
        {
            "vendor": "schneider-electric",
            "product": "easergy_t300"
        },
        {
            "vendor": "schneider-electric",
            "product": "easergy_t300_firmware"
        },
        {
            "vendor": "schneider-electric",
            "product": "epas_gtw"
        },
        {
            "vendor": "schneider-electric",
            "product": "epas_gtw_firmware"
        },
        {
            "vendor": "schneider-electric",
            "product": "mc-31"
        },
        {
            "vendor": "schneider-electric",
            "product": "micom_c264"
        },
        {
            "vendor": "schneider-electric",
            "product": "micom_c264_firmware"
        },
        {
            "vendor": "schneider-electric",
            "product": "pacis_gtw"
        },
        {
            "vendor": "schneider-electric",
            "product": "pacis_gtw_firmware"
        },
        {
            "vendor": "schneider-electric",
            "product": "saitel_dp"
        },
        {
            "vendor": "schneider-electric",
            "product": "saitel_dp_firmware"
        },
        {
            "vendor": "schneider-electric",
            "product": "saitel_dr"
        },
        {
            "vendor": "schneider-electric",
            "product": "saitel_dr_firmware"
        },
        {
            "vendor": "schneider-electric",
            "product": "scd2200_firmware"
        },
        {
            "vendor": "xylem",
            "product": "multismart_firmware"
        }
    ],
    "kev_detail": null,
    "exploits": [],
    "refs_list": [
        "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04",
        "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699",
        "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01",
        "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf",
        "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04",
        "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699",
        "https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01",
        "https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf"
    ]
}