Vulnerability · Published Sep 4, 2024 · Assigned by jpcert

CVE-2024-41716

High 8.1

In plain English

A high-severity security flaw in WindLDR from IDEC Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 61.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. If this vulnerability is exploited, an attacker who obtained the product's project file may obtain user credentials of the PLC or Operator Interfaces. As a result, an attacker may be able to manipulate and/or suspend the PLC and Operator Interfaces by accessing or hijacking them.

Affected products (as reported)

Vendor	Product	Versions
IDEC Corporation	WindLDR	Ver.9.1.0 and earlier
IDEC Corporation	WindO/I-NV4	Ver.3.0.1

Weakness: CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

In plain English

Official description

Affected products (as reported)

References