CVE-2021-37400
Critical
Description
An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
SeverityCritical
CVSS9.8
Exploit probability—
ProductIdec Data File Manager
PublishedDec 28, 2021
First seenDec 28, 2021
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| idec data_file_manager | v ≤ 2.12.1 | — |
| idec windedit | v ≤ 1.3.1 | — |
| idec windldr | v ≤ 8.19.1 | — |
| idec microsmart_plus_fc6b_firmware | v ≤ 2.31 | — |
| idec microsmart_plus_fc6a_firmware | v ≤ 1.91 | — |
| idec microsmart_fc6b_firmware | v ≤ 2.31 | — |
| idec microsmart_fc6a_firmware | v ≤ 2.32 | — |
| idec ft1a_smartaxix_pro_firmware | v ≤ 2.31 | — |
| idec ft1a_smartaxix_lite_firmware | v ≤ 2.31 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.