ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files.
CVSS v4.0 Metrics
Exploitability
Attack VectorNetwork
ComplexityHigh
RequirementsPresent
PrivilegesNone
User InteractionActive
Threat
Exploit MaturityUnreported
Vulnerable System
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Subsequent System
ConfidentialityNone
IntegrityNone
AvailabilityNone
Supplemental
SafetyNegligible
AutomatableYes
RecoveryAutomatic
Value DensityConcentrated
UrgencyMedium
Change Log
| Date | Source | Changes | Score |
|---|
| 2026-07-21 | cve.org | initial, patch: Unavailable | 4.8 |
Affected Software
| Vendor | Product | Version |
|---|
| Rockwell Automation | ISaGRAF Runtime | 4.x |
| Rockwell Automation | ISaGRAF Runtime | 5.x |
| rockwellautomation | aadvance_controller | ≤ 1.40 |
| rockwellautomation | isagraf_free_runtime | ≤ 6.6.8 |
| rockwellautomation | isagraf_runtime | ≥ 5.0, < 6.0 |
| rockwellautomation | micro810_firmware | All versions |
| rockwellautomation | micro820_firmware | All versions |
| rockwellautomation | micro830_firmware | All versions |
| rockwellautomation | micro850_firmware | All versions |
| rockwellautomation | micro870_firmware | All versions |
| schneider-electric | easergy_c5_firmware | < 1.1.0 |
| schneider-electric | easergy_t300_firmware | ≤ 2.7.1 |
| schneider-electric | epas_gtw_firmware | 6.4 |
| schneider-electric | micom_c264_firmware | < d6.1 |
| schneider-electric | pacis_gtw_firmware | 5.1 |
| schneider-electric | pacis_gtw_firmware | 5.2 |
| schneider-electric | pacis_gtw_firmware | 6.1 |
| schneider-electric | pacis_gtw_firmware | 6.3 |
| schneider-electric | saitel_dp_firmware | ≤ 11.06.21 |
| schneider-electric | saitel_dr_firmware | ≤ 11.06.12 |
| schneider-electric | scd2200_firmware | ≤ 10024 |
| xylem | multismart_firmware | < 3.2.0 |
Published: 2022-03-18
