Vulnerability in Idec Data File Manager
CVE-2021-20826
Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from the communication between the PLC and the software. As a result, the complete access privileges to the PLC Web server may be obtained, and manipulation of the PLC output and/or suspension of the PLC may be conducted.
EPSS: 0.004 (31.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.
Affected products
- Idec Data_file_manager
- Idec Microsmart_fc6a
- Idec Microsmart_fc6a_firmware
- Idec Microsmart_plus_fc6a
- Idec Microsmart_plus_fc6a_firmware
- Idec Windedit
- Idec Windldr
- Idec Corporation Plc — versions FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (x_refsource_MISC, Vendor Advisory)
- vultures@jpcert.or.jp (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-20826?
- CVE-2021-20826 is a high-severity vulnerability in Idec Data File Manager, classified under Insufficiently Protected Credentials. CVSS score: 7.6/10. Published 2021-12-24.
- How severe is CVE-2021-20826?
- High severity. CVSS v3 base score is 7.6 out of 10.