CVE-2024-41927 — IDEC Corporation / FC6A Series MICROSmart All-in-One CPU module

Description (CNA)

Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communication port, user credentials may be obtained. As a result, the program of the PLC may be obtained, and the PLC may be manipulated.

Affected (CNA)

Vendor / product	Versions
IDEC Corporation / FC6A Series MICROSmart All-in-One CPU module	affected Ver.2.60 and earlier
IDEC Corporation / FC6B Series MICROSmart All-in-One CPU module	affected Ver.2.60 and earlier
IDEC Corporation / FC6A Series MICROSmart Plus CPU module	affected Ver.2.40 and earlier
IDEC Corporation / FC6B Series MICROSmart Plus CPU module	affected Ver.2.60 and earlier
IDEC Corporation / FT1A Series SmartAXIS Pro/Lite	affected Ver.2.41 and earlier

CWE

CWE-319

References

https://us.idec.com/media/24-RD-0256-EN-b.pdf
https://jvn.jp/en/vu/JVNVU96959731/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.