CVE-2020-25178: schneider-electric easergy t300 firmware +16…

csirt@kutim:~/threat-intel/cve/CVE-2020-25178

CVSS 8.8 · High EPSS 1,7%

Kerentanan Cleartext Transmission of Sensitive Information pada schneider-electric easergy t300 firmware, schneider-electric easergy c5 firmware +15 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files.

Rincian

Terbit di NVD: 18 Maret 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-319: Cleartext Transmission of Sensitive Information
EPSS (30 hari): 1,7% peluang dieksploitasi; lebih tinggi dari 76,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
schneider-electric	easergy t300 firmware	Semua versi hingga 2.7.1
schneider-electric	easergy c5 firmware	Semua versi sebelum 1.1.0
schneider-electric	micom c264 firmware	Semua versi sebelum d6.1
schneider-electric	pacis gtw firmware	Versi 5.1
schneider-electric	pacis gtw firmware	Versi 5.2
schneider-electric	pacis gtw firmware	Versi 6.1
schneider-electric	pacis gtw firmware	Versi 6.3
schneider-electric	saitel dp firmware	Semua versi hingga 11.06.21
schneider-electric	epas gtw firmware	Versi 6.4
schneider-electric	saitel dr firmware	Semua versi hingga 11.06.12
schneider-electric	scd2200 firmware	Semua versi hingga 10024
rockwellautomation	aadvance controller	Semua versi hingga 1.40
rockwellautomation	isagraf free runtime	Semua versi hingga 6.6.8
rockwellautomation	isagraf runtime	Versi 5.0 hingga sebelum 6.0
rockwellautomation	micro810 firmware	Semua versi
rockwellautomation	micro820 firmware	Semua versi
rockwellautomation	micro830 firmware	Semua versi
rockwellautomation	micro850 firmware	Semua versi
rockwellautomation	micro870 firmware	Semua versi
xylem	multismart firmware	Semua versi sebelum 3.2.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04 advisory vendor
https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-multismart-rockwell-isagraf.pdf advisory vendor
https://www.cisa.gov/uscert/ics/advisories/icsa-20-280-01 advisory pihak ketiga · pemerintah AS
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131699 permissions required

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.