Vulnerability identifier: #VU59292
Vulnerability risk: Low
CVSSv3.1: 6.6 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-523
Exploitation vector: Local network
Exploit availability: No
Vulnerable software:
FC6A MICROSmart All-in-One CPU Module
Hardware solutions /
Firmware
FC6B MICROSmart All-in-One CPU Module
Hardware solutions /
Firmware
FC6A MICROSmart Plus CPU Module
Hardware solutions /
Firmware
FC6B MICROSmart Plus CPU Module
Hardware solutions /
Firmware
FT1A Controller SmartAXIS Pro/Lite
Hardware solutions /
Firmware
WindLDR
Hardware solutions /
Firmware
WindEDIT Lite
Hardware solutions /
Firmware
Data File Manager
Hardware solutions /
Firmware
WindEDIT
Hardware solutions /
Firmware
Vendor: IDEC Corporation
Description
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to password leakage. A remote attacker on the local network can obtain the user credentials from the communication between the PLC and the software.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
FC6A MICROSmart All-in-One CPU Module: 2.32
FC6B MICROSmart All-in-One CPU Module: 2.31
FC6A MICROSmart Plus CPU Module: 1.91
FC6B MICROSmart Plus CPU Module: 2.31
FT1A Controller SmartAXIS Pro/Lite: 2.31
WindLDR: 8.19.1
WindEDIT Lite: 1.3.1
Data File Manager: 2.12.1
WindEDIT: 1.3.1
External links
http://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-Organizer
http://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf
http://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6A
http://jvn.jp/en/vu/JVNVU92279973/
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.