Details of VAR-202112-2027

ID

VAR-202112-2027

CVE

CVE-2021-37400

TITLE

IDEC Made PLC Multiple vulnerabilities in

Trust: 0.8

sources: JVNDB: JVNDB-2021-006117

DESCRIPTION

An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered, and/or downloaded. IDEC Provided by Co., Ltd. PLC The following multiple vulnerabilities exist in. * Sending unprotected credentials ( CWE-523 ) - CVE-2021-37400 ‥ * Plaintext storage of authentication information ( CWE-256 ) - CVE-2021-374010 ‥ * Sending unprotected credentials ( CWE-523 ) - CVE-2021-20826 ‥ * Plaintext storage of authentication information ( CWE-256 ) - CVE-2021-20827 This vulnerability information is reported directly to the product developer by the following reporter, and is provided by the product developer. JPCERT/CC There is an adjustment request in JPCERT/CC Is a reporter, product developer, ICS-CERT We made adjustments with and announced it. Reporter : FM Approvals Khalid Ansari MrThe expected impact depends on each vulnerability, but it may be affected as follows. - CVE-2021-37400 ‥ * File server, backup repository, SD Saved on a card etc. ZLD From the file, the user's credentials are obtained by a third party. as a result, PLC Web Deprived of full access to the server, PLC The output of PLC Is stopped - CVE-2021-20826 ‥ * File server, backup repository, SD Saved on a card etc. ZLD From the file, by a third party PLC Web The server user's authentication information is acquired. as a result, PLC Web Connect to the server and PLC By being hijacked PLC The output of PLC Is stopped - CVE-2021-20827 ‥ * Data file manager v2.13.0 And later. IDEC PLC is a programmable controller

Trust: 2.25

sources: NVD: CVE-2021-37400 // JVNDB: JVNDB-2021-006117 // CNVD: CNVD-2022-02762 // VULMON: CVE-2021-37400

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2022-02762

AFFECTED PRODUCTS

vendor:	idec	model:	ft1a smartaxix lite	scope:	lte	version:	2.31	Trust: 1.0
vendor:	idec	model:	windedit	scope:	lte	version:	1.3.1	Trust: 1.0
vendor:	idec	model:	microsmart plus fc6a	scope:	lte	version:	1.91	Trust: 1.0
vendor:	idec	model:	microsmart fc6a	scope:	lte	version:	2.32	Trust: 1.0
vendor:	idec	model:	data file manager	scope:	lte	version:	2.12.1	Trust: 1.0
vendor:	idec	model:	ft1a smartaxix pro	scope:	lte	version:	2.31	Trust: 1.0
vendor:	idec	model:	microsmart plus fc6b	scope:	lte	version:	2.31	Trust: 1.0
vendor:	idec	model:	microsmart fc6b	scope:	lte	version:	2.31	Trust: 1.0
vendor:	idec	model:	windldr	scope:	lte	version:	8.19.1	Trust: 1.0
vendor:	idec株式会社	model:	ft1a 形コントローラ smartaxis pro/lite	scope:	-	version:	-	Trust: 0.8
vendor:	idec株式会社	model:	fc6a 形 microsmart all-in-one cpu モジュール	scope:	-	version:	-	Trust: 0.8
vendor:	idec株式会社	model:	fc6a 形 microsmart plus cpu モジュール	scope:	-	version:	-	Trust: 0.8
vendor:	idec株式会社	model:	fc6b 形 microsmart plus cpu モジュール	scope:	-	version:	-	Trust: 0.8
vendor:	idec株式会社	model:	windldr	scope:	-	version:	-	Trust: 0.8
vendor:	idec株式会社	model:	windedit lite	scope:	-	version:	-	Trust: 0.8
vendor:	idec株式会社	model:	データファイルマネージャー	scope:	-	version:	-	Trust: 0.8
vendor:	idec株式会社	model:	fc6b 形 microsmart all-in-one cpu モジュール	scope:	-	version:	-	Trust: 0.8
vendor:	idec	model:	plc	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2022-02762 // JVNDB: JVNDB-2021-006117 // NVD: CVE-2021-37400

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-37400
value:	CRITICAL
Trust: 1.0
OTHER:	JVNDB-2021-006117
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2022-02762
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202112-2604
value:	CRITICAL
Trust: 0.6
VULMON:	CVE-2021-37400
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2021-37400
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
CNVD:	CNVD-2022-02762
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2021-37400
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2021-006117
baseSeverity:	HIGH
baseScore:	7.6
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2022-02762 // VULMON: CVE-2021-37400 // JVNDB: JVNDB-2021-006117 // CNNVD: CNNVD-202112-2604 // NVD: CVE-2021-37400

PROBLEMTYPE DATA

problemtype:	CWE-522	Trust: 1.0
problemtype:	Plaintext storage of credentials (CWE-256) [ Other ]	Trust: 0.8
problemtype:	Unprotected transfer of credentials (CWE-523) [ Other ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-006117 // NVD: CVE-2021-37400

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202112-2604

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202112-2604

PATCH

title:	Our company PLC Contact regarding the vulnerability of	url:	https://support.quest.com/ja-jp/kb/288310/cert-coordination-center-report-update	Trust: 0.8
title:	Patch for Unknown Vulnerability in IDEC PLC	url:	https://www.cnvd.org.cn/patchInfo/show/313181	Trust: 0.6
title:	IDEC PLC Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=176483	Trust: 0.6

sources: CNVD: CNVD-2022-02762 // JVNDB: JVNDB-2021-006117 // CNNVD: CNNVD-202112-2604

EXTERNAL IDS

db:	NVD	id:	CVE-2021-37400	Trust: 3.1
db:	JVN	id:	JVNVU92279973	Trust: 2.5
db:	ICS CERT	id:	ICSA-22-006-03	Trust: 1.4
db:	JVNDB	id:	JVNDB-2021-006117	Trust: 1.4
db:	CNVD	id:	CNVD-2022-02762	Trust: 0.6
db:	CS-HELP	id:	SB2022010709	Trust: 0.6
db:	AUSCERT	id:	ESB-2022.0083	Trust: 0.6
db:	CNNVD	id:	CNNVD-202112-2604	Trust: 0.6
db:	VULMON	id:	CVE-2021-37400	Trust: 0.1

sources: CNVD: CNVD-2022-02762 // VULMON: CVE-2021-37400 // JVNDB: JVNDB-2021-006117 // CNNVD: CNNVD-202112-2604 // NVD: CVE-2021-37400

REFERENCES

url:	https://us.idec.com/idec-us/en/usd/software-downloads-automation-organizer	Trust: 1.7
url:	https://www.idec.com/home/lp/pdf/2021-12-24-plc.pdf	Trust: 1.7
url:	https://us.idec.com/idec-us/en/usd/programmable-logic-controller/micro-plc/fc6a-microsmart/c/microsmart_fc6a	Trust: 1.7
url:	https://jvn.jp/en/vu/jvnvu92279973/	Trust: 1.7
url:	http://jvn.jp/cert/jvnvu92279973/	Trust: 0.8
url:	https://www.cisa.gov/uscert/ics/advisories/icsa-22-006-03	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2021-37400	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2022010709	Trust: 0.6
url:	https://us-cert.cisa.gov/ics/advisories/icsa-22-006-03	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2022.0083	Trust: 0.6
url:	https://jvndb.jvn.jp/en/contents/2021/jvndb-2021-006117.html	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/522.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2022-02762 // VULMON: CVE-2021-37400 // JVNDB: JVNDB-2021-006117 // CNNVD: CNNVD-202112-2604 // NVD: CVE-2021-37400

CREDITS

Khalid Ansari of FM Approvals reported these vulnerabilities to IDEC Corporation.

Trust: 0.6

sources: CNNVD: CNNVD-202112-2604

SOURCES

db:	CNVD	id:	CNVD-2022-02762
db:	VULMON	id:	CVE-2021-37400
db:	JVNDB	id:	JVNDB-2021-006117
db:	CNNVD	id:	CNNVD-202112-2604
db:	NVD	id:	CVE-2021-37400

LAST UPDATE DATE

2024-08-14T14:11:05.075000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2022-02762	date:	2022-01-18T00:00:00
db:	VULMON	id:	CVE-2021-37400	date:	2022-01-07T00:00:00
db:	JVNDB	id:	JVNDB-2021-006117	date:	2022-01-11T07:34:00
db:	CNNVD	id:	CNNVD-202112-2604	date:	2022-01-10T00:00:00
db:	NVD	id:	CVE-2021-37400	date:	2022-01-07T20:40:19.347

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2022-02762	date:	2022-01-12T00:00:00
db:	VULMON	id:	CVE-2021-37400	date:	2021-12-28T00:00:00
db:	JVNDB	id:	JVNDB-2021-006117	date:	2021-12-27T00:00:00
db:	CNNVD	id:	CNNVD-202112-2604	date:	2021-12-24T00:00:00
db:	NVD	id:	CVE-2021-37400	date:	2021-12-28T13:15:08.207