Sign-up

ID

VAR-202112-2026


CVE

CVE-2021-37401


TITLE

IDEC  Made  PLC  Multiple vulnerabilities in

Trust: 0.8

sources: JVNDB: JVNDB-2021-006117

DESCRIPTION

An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC user program may be uploaded, altered, and/or downloaded. IDEC Provided by Co., Ltd. PLC The following multiple vulnerabilities exist in. * Sending unprotected credentials ( CWE-523 ) - CVE-2021-37400 ‥ * Plaintext storage of authentication information ( CWE-256 ) - CVE-2021-374010 ‥ * Sending unprotected credentials ( CWE-523 ) - CVE-2021-20826 ‥ * Plaintext storage of authentication information ( CWE-256 ) - CVE-2021-20827 This vulnerability information is reported directly to the product developer by the following reporter, and is provided by the product developer. JPCERT/CC There is an adjustment request in JPCERT/CC Is a reporter, product developer, ICS-CERT We made adjustments with and announced it. Reporter : FM Approvals Khalid Ansari MrThe expected impact depends on each vulnerability, but it may be affected as follows. * By a third party PLC User authentication information is obtained from the communication between the software and the software. ZLD From the file, the user's credentials are obtained by a third party. - CVE-2021-37401 ‥ * By a third party PLC From communication between software and PLC Web The server user's authentication information is acquired. as a result, PLC Web Deprived of full access to the server, PLC The output of PLC Is stopped - CVE-2021-20826 ‥ * File server, backup repository, SD Saved on a card etc. ZLD From the file, by a third party PLC Web The server user's authentication information is acquired. as a result, PLC Web Connect to the server and PLC By being hijacked PLC The output of PLC Is stopped - CVE-2021-20827 ‥ * Data file manager v2.13.0 And later. IDEC PLC is a programmable controller

Trust: 2.25

sources: NVD: CVE-2021-37401 // JVNDB: JVNDB-2021-006117 // CNVD: CNVD-2022-02761 // VULMON: CVE-2021-37401

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-02761

AFFECTED PRODUCTS

vendor:idecmodel:ft1a smartaxix litescope:lteversion:2.31

Trust: 1.0

vendor:idecmodel:windeditscope:lteversion:1.3.1

Trust: 1.0

vendor:idecmodel:microsmart plus fc6ascope:lteversion:1.91

Trust: 1.0

vendor:idecmodel:microsmart fc6ascope:lteversion:2.32

Trust: 1.0

vendor:idecmodel:data file managerscope:lteversion:2.12.1

Trust: 1.0

vendor:idecmodel:ft1a smartaxix proscope:lteversion:2.31

Trust: 1.0

vendor:idecmodel:microsmart plus fc6bscope:lteversion:2.31

Trust: 1.0

vendor:idecmodel:microsmart fc6bscope:lteversion:2.31

Trust: 1.0

vendor:idecmodel:windldrscope:lteversion:8.19.1

Trust: 1.0

vendor:idec株式会社model:ft1a 形 コントローラ smartaxis pro/litescope: - version: -

Trust: 0.8

vendor:idec株式会社model:fc6a 形 microsmart all-in-one cpu モジュールscope: - version: -

Trust: 0.8

vendor:idec株式会社model:fc6a 形 microsmart plus cpu モジュールscope: - version: -

Trust: 0.8

vendor:idec株式会社model:fc6b 形 microsmart plus cpu モジュールscope: - version: -

Trust: 0.8

vendor:idec株式会社model:windldrscope: - version: -

Trust: 0.8

vendor:idec株式会社model:windedit litescope: - version: -

Trust: 0.8

vendor:idec株式会社model:データ ファイル マネージャーscope: - version: -

Trust: 0.8

vendor:idec株式会社model:fc6b 形 microsmart all-in-one cpu モジュールscope: - version: -

Trust: 0.8

vendor:idecmodel:plcscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2022-02761 // JVNDB: JVNDB-2021-006117 // NVD: CVE-2021-37401

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-37401
value: CRITICAL

Trust: 1.0

OTHER: JVNDB-2021-006117
value: HIGH

Trust: 0.8

CNVD: CNVD-2022-02761
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202112-2603
value: CRITICAL

Trust: 0.6

VULMON: CVE-2021-37401
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-37401
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2022-02761
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-37401
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

OTHER: JVNDB-2021-006117
baseSeverity: HIGH
baseScore: 7.6
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-02761 // VULMON: CVE-2021-37401 // JVNDB: JVNDB-2021-006117 // CNNVD: CNNVD-202112-2603 // NVD: CVE-2021-37401

PROBLEMTYPE DATA

problemtype:CWE-522

Trust: 1.0

problemtype:Plaintext storage of credentials (CWE-256) [ Other ]

Trust: 0.8

problemtype: Unprotected transfer of credentials (CWE-523) [ Other ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-006117 // NVD: CVE-2021-37401

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202112-2603

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202112-2603

PATCH

title:Our company  PLC  Contact regarding the vulnerability ofurl:https://support.quest.com/ja-jp/kb/288310/cert-coordination-center-report-update

Trust: 0.8

title:Patch for Unknown Vulnerability in IDEC PLC (CNVD-2022-02761)url:https://www.cnvd.org.cn/patchInfo/show/313186

Trust: 0.6

title:IDEC PLC Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=176482

Trust: 0.6

sources: CNVD: CNVD-2022-02761 // JVNDB: JVNDB-2021-006117 // CNNVD: CNNVD-202112-2603

EXTERNAL IDS

db:NVDid:CVE-2021-37401

Trust: 3.1

db:JVNid:JVNVU92279973

Trust: 2.5

db:ICS CERTid:ICSA-22-006-03

Trust: 1.4

db:JVNDBid:JVNDB-2021-006117

Trust: 1.4

db:CNVDid:CNVD-2022-02761

Trust: 0.6

db:CS-HELPid:SB2022010709

Trust: 0.6

db:AUSCERTid:ESB-2022.0083

Trust: 0.6

db:CNNVDid:CNNVD-202112-2603

Trust: 0.6

db:VULMONid:CVE-2021-37401

Trust: 0.1

sources: CNVD: CNVD-2022-02761 // VULMON: CVE-2021-37401 // JVNDB: JVNDB-2021-006117 // CNNVD: CNNVD-202112-2603 // NVD: CVE-2021-37401

REFERENCES

url:https://us.idec.com/idec-us/en/usd/software-downloads-automation-organizer

Trust: 1.7

url:https://www.idec.com/home/lp/pdf/2021-12-24-plc.pdf

Trust: 1.7

url:https://us.idec.com/idec-us/en/usd/programmable-logic-controller/micro-plc/fc6a-microsmart/c/microsmart_fc6a

Trust: 1.7

url:https://jvn.jp/en/vu/jvnvu92279973/

Trust: 1.7

url:http://jvn.jp/cert/jvnvu92279973/

Trust: 0.8

url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-006-03

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-37401

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022010709

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-006-03

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0083

Trust: 0.6

url:https://jvndb.jvn.jp/en/contents/2021/jvndb-2021-006117.html

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/522.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2022-02761 // VULMON: CVE-2021-37401 // JVNDB: JVNDB-2021-006117 // CNNVD: CNNVD-202112-2603 // NVD: CVE-2021-37401

CREDITS

Khalid Ansari of FM Approvals reported these vulnerabilities to IDEC Corporation.

Trust: 0.6

sources: CNNVD: CNNVD-202112-2603

SOURCES

db:CNVDid:CNVD-2022-02761
db:VULMONid:CVE-2021-37401
db:JVNDBid:JVNDB-2021-006117
db:CNNVDid:CNNVD-202112-2603
db:NVDid:CVE-2021-37401

LAST UPDATE DATE

2024-08-14T14:11:05.043000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-02761date:2022-01-18T00:00:00
db:VULMONid:CVE-2021-37401date:2022-01-07T00:00:00
db:JVNDBid:JVNDB-2021-006117date:2022-01-11T07:34:00
db:CNNVDid:CNNVD-202112-2603date:2022-01-10T00:00:00
db:NVDid:CVE-2021-37401date:2022-01-07T20:29:50.673

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-02761date:2022-01-12T00:00:00
db:VULMONid:CVE-2021-37401date:2021-12-28T00:00:00
db:JVNDBid:JVNDB-2021-006117date:2021-12-27T00:00:00
db:CNNVDid:CNNVD-202112-2603date:2021-12-24T00:00:00
db:NVDid:CVE-2021-37401date:2021-12-28T13:15:08.267