PT-2021-21634 · Idec · Data File Manager+6

Khalid Ansari · Published 2021-12-28 · Updated 2022-01-07 · CVE-2021-37400

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description An attacker may obtain user credentials from the communication between the Programmable Logic Controller (PLC) and the software. This could allow the PLC user program to be uploaded, altered, and/or downloaded.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-37400

Affected Products

Data File Manager

Ft1A Smartaxix Lite Firmware

Ft1A Smartaxix Pro Firmware

Microsmart Plus Fc6A Firmware

Microsmart Plus Fc6B Firmware

Windedit

Windldr

References · 7

• https://idec.com/home/lp/pdf/2021-12-24-PLC.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37400 · Vendor Advisory
• https://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-Organizer · Vendor Advisory
• https://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6A · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37400 · Security Note
• https://t.me/cibsecurity/34704 · Telegram Post
• https://jvn.jp/en/vu/JVNVU92279973 · Note