| Package | Affected versions | Patched versions |
|---|---|---|
| aadvance controller | ≤ 1.40 | |
| isagraf free runtime | ≤ 6.6.8 | |
| isagraf runtime | ≥ 5.0, < 6.0 | 6.0 |
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free