Skip to content
Fencer Vulns
high 7.6

CVE-2021-20826 json

Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Serie…

published 2021-12-24 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-8238

cvss
7.6
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from the communication between the PLC and the software. As a result, the complete access privileges to the PLC Web server may be obtained, and manipulation of the PLC output and/or suspension of the PLC may be conducted.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-006-03 updated cvss 7.6

IDEC PLCs

  • IDEC Data File Manager <= 2.12.1 IDEC FC6A MICROSmart All-in-One CPU Module <= 2.32 IDEC FC6A MICROSmart Plus CPU Module <= 1.91 IDEC FC6B MICROSmart All-in-One CPU Module <= 2.31 IDEC FC6B MICROSmart Plus CPU Module <= 2.31 IDEC FT1A Controller SmartAXIS Pro/Lite <= 2.31
    +3 more products
    IDEC WindEDIT <= 1.3.1 IDEC WindEDIT Lite <= 1.3.1 IDEC WindLDR <= 8.19.1
    affected: vendor fix, mitigation “FC6A MICROSmart All-in-One CPU Module: v2.40 and later” idec.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
NVD 2.0 3.3 AV:A/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • IDEC Corporation IDEC PLC

Classification

Weakness
  • CWE-522 Insufficiently Protected Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.