critical9.8
CVE-2021-37400
An attacker may obtain the user credentials from the communication between the PLC and the software.
Impact
An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Idec | Data File Manager | through 2.12.1 |
| Idec | Windedit | through 1.3.1 |
| Idec | Windldr | through 8.19.1 |
| Idec | Microsmart Plus Fc6b Firmware | through 2.31 |
| Idec | Microsmart Plus Fc6a Firmware | through 1.91 |
| Idec | Microsmart Fc6b Firmware | through 2.31 |
| Idec | Microsmart Fc6a Firmware | through 2.32 |
| Idec | Ft1a Smartaxix Pro Firmware | through 2.31 |
| Idec | Ft1a Smartaxix Lite Firmware | through 2.31 |
Weakness classification
References
- NVD record
- CVE.org record
- https://jvn.jp/en/vu/JVNVU92279973/
- https://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6A
- https://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-Organizer
- https://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf
- https://jvn.jp/en/vu/JVNVU92279973/
- https://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6A
- https://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-Organizer
- https://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf