PT-2021-14272 · Idec · Idec Fc6A Series Microsmart All-In-One Cpu Module+1
Khalid Ansari
·
Published
2021-12-24
·
Updated
2022-01-11
·
CVE-2021-20827
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
IDEC FC6A Series MICROSmart All-in-One CPU module versions v2.32 and earlier
IDEC FC6A Series MICROSmart Plus CPU module versions v1.91 and earlier
WindLDR versions v8.19.1 and earlier
WindEDIT Lite versions v1.3.1 and earlier
Data File Manager versions v2.12.1 and earlier
Description:
A plaintext storage of a password issue allows an attacker to obtain the PLC Web server user credentials from file servers, backup repositories, or ZLD files saved in SD cards. This could enable the attacker to access the PLC Web server, hijack the PLC, and potentially manipulate the PLC output or suspend the PLC.
Recommendations:
For IDEC FC6A Series MICROSmart All-in-One CPU module versions v2.32 and earlier, update to a version later than v2.32 to resolve the issue.
For IDEC FC6A Series MICROSmart Plus CPU module versions v1.91 and earlier, update to a version later than v1.91 to resolve the issue.
For WindLDR versions v8.19.1 and earlier, update to a version later than v8.19.1 to resolve the issue.
For WindEDIT Lite versions v1.3.1 and earlier, update to a version later than v1.3.1 to resolve the issue.
For Data File Manager versions v2.12.1 and earlier, update to a version later than v2.12.1 to resolve the issue.
Fix
Cleartext Storage of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Idec Fc6A Series Microsmart All-In-One Cpu Module
Idec Fc6A Series Microsmart Plus Cpu Module