Skip to content
OpenAdvisories
High ICSA-22-006-03 4 CVEs

IDEC PLCs

Published Jan 6, 2022 · Updated Jan 6, 2022

Vendor: IDEC Product: Data File Manager Product: FC6A MICROSmart All-in-One CPU Module Product: FC6A MICROSmart Plus CPU Module Product: FC6B MICROSmart All-in-One CPU Module Product: FC6B MICROSmart Plus CPU Module Product: FT1A Controller SmartAXIS Pro/Lite Product: WindEDIT Product: WindEDIT Lite Product: WindLDR

Summary

Successful exploitation of these vulnerabilities could allow an attacker to upload, alter, and/or download the PLC user program. An attacker could also access the PLC web server and hijack the controllers, resulting in the manipulation and/or suspension of the PLC output.

Vulnerabilities 4

  • Unscored —
    CVE-2021-20826

    Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and…

    IDEC IDEC PLC
  • Unscored —
    CVE-2021-20827

    Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earl…

    IDEC IDEC PLC
  • Unscored —
    CVE-2021-37400

    An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the P…

  • Unscored —
    CVE-2021-37401

    An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As …

Revision history

  1. #1

    ICSA-22-006-03 IDEC PLCs

References