Vulnerability in Idec Data File Manager
CVE-2021-20827
Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the attacker may access the PLC Web server and hijack the PLC, and manipulation of the PLC output and/or suspension of the PLC may be conducted.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (46.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 46.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Idec Data File Manager
- Idec Microsmart Fc6a
- Idec Microsmart Fc6a Firmware
- Idec Microsmart Plus Fc6a
- Idec Microsmart Plus Fc6a Firmware
- Idec Windedit
- Idec Windldr
- Idec Corporation Plc — versions FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier
Weakness classification (CWE)
References
- www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf (Vendor Advisory)
- jvn.jp/en/vu/JVNVU92279973/index.html (Third Party Advisory)
Frequently asked questions
- What is CVE-2021-20827?
- CVE-2021-20827 is a high-severity vulnerability in Idec Data File Manager, classified under Cleartext Storage of Sensitive Information. CVSS score: 7.5/10. Published 2021-12-24.
- How severe is CVE-2021-20827?
- High severity. CVSS v3 base score is 7.5 out of 10.