Vulnerability in Idec Data File Manager
CVE-2021-20827
Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the attacker may access the PLC Web server and hijack the PLC, and manipulation of the PLC output and/or suspension of the PLC may be conducted.
EPSS: 0.006 (44.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Idec Data_file_manager
- Idec Microsmart_fc6a
- Idec Microsmart_fc6a_firmware
- Idec Microsmart_plus_fc6a
- Idec Microsmart_plus_fc6a_firmware
- Idec Windedit
- Idec Windldr
- Idec Corporation Plc — versions FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (x_refsource_MISC, Vendor Advisory)
- vultures@jpcert.or.jp (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-20827?
- CVE-2021-20827 is a high-severity vulnerability in Idec Data File Manager, classified under Cleartext Storage of Sensitive Information. CVSS score: 7.5/10. Published 2021-12-24.
- How severe is CVE-2021-20827?
- High severity. CVSS v3 base score is 7.5 out of 10.