Vulnerability identifier: #VU59297

Vulnerability risk: Low

CVSSv3.1: 6.6 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-20827

CWE-ID: CWE-256

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
FC6A MICROSmart All-in-One CPU Module
Hardware solutions / Firmware
FC6B MICROSmart All-in-One CPU Module
Hardware solutions / Firmware
FC6A MICROSmart Plus CPU Module
Hardware solutions / Firmware
FC6B MICROSmart Plus CPU Module
Hardware solutions / Firmware
FT1A Controller SmartAXIS Pro/Lite
Hardware solutions / Firmware
WindLDR
Hardware solutions / Firmware
WindEDIT Lite
Hardware solutions / Firmware
Data File Manager
Hardware solutions / Firmware
WindEDIT
Hardware solutions / Firmware

Vendor: IDEC Corporation

Description

The vulnerability allows a remote attacker to gain access to other users' credentials.

The vulnerability exists due to application stored credentials in plain text in a configuration file on the system. A remote attacker on the local network can obtain the PLC web server user credentials from file servers, backup repositories, or ZLD files saved in SD cards.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

FC6A MICROSmart All-in-One CPU Module: 2.32

FC6B MICROSmart All-in-One CPU Module: 2.31

FC6A MICROSmart Plus CPU Module: 1.91

FC6B MICROSmart Plus CPU Module: 2.31

FT1A Controller SmartAXIS Pro/Lite: 2.31

WindLDR: 8.19.1

WindEDIT Lite: 1.3.1

Data File Manager: 2.12.1

WindEDIT: 1.3.1

---

External links
http://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-Organizer
http://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf
http://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6A
http://jvn.jp/en/vu/JVNVU92279973/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.