#VU59297 Unprotected storage of credentials in IDEC Corporation products - CVE-2021-20827

Vulnerability identifier: #VU59297

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2021-20827

CWE-ID: CWE-256

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerable software:
FC6A MICROSmart All-in-One CPU Module
FC6B MICROSmart All-in-One CPU Module
FC6A MICROSmart Plus CPU Module
FC6B MICROSmart Plus CPU Module
FT1A Controller SmartAXIS Pro/Lite
WindLDR
WindEDIT Lite
Data File Manager
WindEDIT

Software vendor:
IDEC Corporation

The vulnerability allows a remote attacker to gain access to other users' credentials.

The vulnerability exists due to application stored credentials in plain text in a configuration file on the system. A remote attacker on the local network can obtain the PLC web server user credentials from file servers, backup repositories, or ZLD files saved in SD cards.

Install updates from vendor's website.

• https://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-Organizer
• https://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf
• https://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6A
• https://jvn.jp/en/vu/JVNVU92279973/