13 July 2021
KLCERT-20-024: Rockwell Automation ISaGRAF Runtime: Code Execution due to Uncontrolled Search Path Element
Vendor
-
CVE
-
KLCERT
KLCERT-20-024
Timeline
Timeline
-
Kaspersky ICS CERT advisory published
13 July 2021
-
Vendor advisory published
08 June 2021
-
Vendor confirmation
11 March 2020
-
Vulnerability reported
21 February 2020
Description
ISaGRAF Runtime for Microsoft Windows searches its directory for all files that have extension “.dll” and loads them as dynamic libraries.
CVSS v3
Exploitability
Locally exploitable
Attack complexity
Privilege required
User interaction
Confidentiality
Impact
Uncontrolled loading of dynamic libraries could allow a local attacker to execute arbitrary code.
Affected products
- Based on ISaGRAF Runtime 5 controllers:
- All software versions
- ISaGRAF Free Runtime:
- All software versions
Mitigation
Rockwell Automation mitigation
Rockwell Automation recommends upgrading to ISaGRAF Runtime 5 version 5.72.00.
Since ISaGRAF 5 Runtime is provided to a customer as a development kit, implementing least-privilege may vary from implementation to implementation based on the hardware in use.
Customers should ensure that the least-privilege user principle is followed, and user/service account access to Runtime’s folder location is granted with a minimum amount of rights as needed.
Kaspersky publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.
