Skip to content
Fencer Vulns
high 7.5

CVE-2021-20827 json

Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MIC…

published 2021-12-24 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-8239

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the attacker may access the PLC Web server and hijack the PLC, and manipulation of the PLC output and/or suspension of the PLC may be conducted.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-006-03 updated cvss 7.6

IDEC PLCs

  • IDEC Data File Manager <= 2.12.1 IDEC FC6A MICROSmart All-in-One CPU Module <= 2.32 IDEC FC6A MICROSmart Plus CPU Module <= 1.91 IDEC FC6B MICROSmart All-in-One CPU Module <= 2.31 IDEC FC6B MICROSmart Plus CPU Module <= 2.31 IDEC FT1A Controller SmartAXIS Pro/Lite <= 2.31
    +3 more products
    IDEC WindEDIT <= 1.3.1 IDEC WindEDIT Lite <= 1.3.1 IDEC WindLDR <= 8.19.1
    affected: vendor fix, mitigation “FC6A MICROSmart All-in-One CPU Module: v2.40 and later” idec.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • IDEC Corporation IDEC PLC

Classification

Weakness
  • CWE-312 Cleartext Storage of Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.