Vulnerability in Idec Data File Manager
CVE-2021-20826
Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from the communication between the PLC and the software. As a result, the complete access privileges to the PLC Web server may be obtained, and manipulation of the PLC output and/or suspension of the PLC may be conducted.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (30.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 30.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Idec Data File Manager
- Idec Microsmart Fc6a
- Idec Microsmart Fc6a Firmware
- Idec Microsmart Plus Fc6a
- Idec Microsmart Plus Fc6a Firmware
- Idec Windedit
- Idec Windldr
- Idec Corporation Plc — versions FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier
Weakness classification (CWE)
References
- www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf (Vendor Advisory)
- jvn.jp/en/vu/JVNVU92279973/index.html (Third Party Advisory)
Frequently asked questions
- What is CVE-2021-20826?
- CVE-2021-20826 is a high-severity vulnerability in Idec Data File Manager, classified under Insufficiently Protected Credentials. CVSS score: 7.6/10. Published 2021-12-24.
- How severe is CVE-2021-20826?
- High severity. CVSS v3 base score is 7.6 out of 10.