Kaspersky publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.
|CWE||CWE-312: Cleartext Storage of Sensitive Information|
ISaGRAF Runtime stores the password in plaintext in memory and in a file which is located in the same directory with the executable file ISAGRAF.exe.
A local attacker could compromise the user’s password by dumping memory or reading a specific file.
|CVSS v3 Base Score||5.5 (Medium)|
|Difficulty||⚠ Low skill level to exploit: an attacker must perform Man-in-the-Middle attack|
|Privilege required||Low privilege level required: it is required to have “read” privilege level on the filesystem|
|User interaction||⚠ No user interaction required|
|Confidentiality||⚠ Confidentiality of the system may be seriously affected|
|Rockwell Automation mitigation||
Rockwell Automation recommends upgrading to ISaGRAF Runtime 5 version 5.72.00.
Customers should ensure that the least-privilege user principle is followed, and user/service account access to Runtime’s folder location is granted with a minimum amount of rights as needed.
For ISaGRAF, restrict or block traffic on TCP 1131 from outside of the industrial control system network zone. For more information on the TCP/UDP ports used by ISaGRAF refer to product documentation.
Since ISaGRAF 5 Runtime is provided to a customer as a development kit, implementing least-privilege may vary from implementation to implementation based on the hardware in use.
For AADvance controllers, customers are encouraged to restrict or block traffic on TCP 1132 from outside of the industrial control system network zone.1
2020-02-21 – Vulnerability reported
2020-03-11 – Rockwell Automation confirmed the vulnerability
2021-06-08 – Rockwell Automation published the advisory
2021-06-17 – ICS CERT published the advisory