What’s Vulnerable › Vulnerabilities

CVE-2021-37401

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-28 · updated 2026-06-17
• Weakness: CWE-522

Description

An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC user program may be uploaded, altered, and/or downloaded.

Affected products

• Idec Data File Manager: through 2.12.1
• Idec Ft1A Smartaxix Lite Firmware: through 2.31
• Idec Ft1A Smartaxix Pro Firmware: through 2.31
• Idec Microsmart Fc6A Firmware: through 2.32
• Idec Microsmart Fc6B Firmware: through 2.31
• Idec Microsmart Plus Fc6A Firmware: through 1.91
• Idec Microsmart Plus Fc6B Firmware: through 2.31
• Idec Windedit: through 1.3.1
• IDEC Corporation WindLDR: through 8.19.1

References

• https://jvn.jp/en/vu/JVNVU92279973/
• https://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6A
• https://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-Organizer
• https://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf
• https://jvn.jp/en/vu/JVNVU92279973/
• https://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6A
• https://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-Organizer
• https://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdf

Get alerted when CVE-2021-37401 or the next vulnerability affects your stack