Vulnerability · Published Sep 4, 2024 · Assigned by jpcert
CVE-2024-41927
Medium 4.6
In plain English
A medium-severity security flaw in FC6A Series MICROSmart All-in-One CPU module from IDEC Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.2%top 95.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communication port, user credentials may be obtained. As a result, the program of the PLC may be obtained, and the PLC may be manipulated.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IDEC Corporation | FC6A Series MICROSmart All-in-One CPU module | Ver.2.60 and earlier |
| IDEC Corporation | FC6B Series MICROSmart All-in-One CPU module | Ver.2.60 and earlier |
| IDEC Corporation | FC6A Series MICROSmart Plus CPU module | Ver.2.40 and earlier |
| IDEC Corporation | FC6B Series MICROSmart Plus CPU module | Ver.2.60 and earlier |
| IDEC Corporation | FT1A Series SmartAXIS Pro/Lite | Ver.2.41 and earlier |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N