CVE-2021-20826

Katalog CVE

CVSS 7.6 · High EPSS 0,39%

Kerentanan Insufficiently Protected Credentials pada idec microsmart fc6a firmware, idec microsmart plus fc6a firmware +3 lainnya. Skor CVSS 3.1 7.6 (High) menurut NVD.

Deskripsi (NVD)

Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from the communication between the PLC and the software. As a result, the complete access privileges to the PLC Web server may be obtained, and manipulation of the PLC output and/or suspension of the PLC may be conducted.

Rincian

Terbit di NVD

24 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.6 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf advisory vendor
• https://jvn.jp/en/vu/JVNVU92279973/index.html advisory pihak ketiga