Skip to content
Fencer Vulns
high 7.5

CVE-2021-27477 json

When JTEKT Corporation TOYOPUC PLC versions PC10G-CPU, 2PORT-EFR, Plus CPU, Plus EX, Plus EX2, Plus EFR, Plus EFR2, Plus 2P-EFR, PC10P-DP,…

published 2021-07-01 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-14231

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

When JTEKT Corporation TOYOPUC PLC versions PC10G-CPU, 2PORT-EFR, Plus CPU, Plus EX, Plus EX2, Plus EFR, Plus EFR2, Plus 2P-EFR, PC10P-DP, PC10P-DP-IO, Plus BUS-EX, Nano 10GX, Nano 2ET,PC10PE, PC10PE-16/16P, PC10E, FL/ET-T-V2H, PC10B,PC10B-P, Nano CPU, PC10P, and PC10GE receive an invalid frame, the outside area of a receive buffer for FL-net are overwritten. As a result, the PLC CPU detects a system error, and the affected products stop.

Patch / fix

  • jtekt pc10g-cpu_firmware 3.91
  • jtekt 2port-efr_firmware 1.50
  • jtekt plus_cpu_firmware 3.11
  • jtekt plus_ex_firmware 3.11
  • jtekt plus_ex2_firmware 3.11
  • jtekt plus_efr_firmware 3.11
  • jtekt plus_efr2_firmware 3.11
  • jtekt plus_2p-efr_firmware 3.11
  • jtekt pc10p-dp_firmware 1.50
  • jtekt pc10p-dp-io_firmware 1.50
  • jtekt plus_bus-ex_firmware 2.13
  • jtekt nano_10gx_firmware 3.00
  • jtekt nano_2et_firmware 2.40
  • jtekt pc10pe_firmware 1.02
  • jtekt pc10pe-16/16p_firmware 1.02
  • jtekt pc10e_firmware 1.02
  • jtekt fl/et-t-v2h_firmware f2.8_e1.5
  • jtekt pc10b_firmware 1.11
  • jtekt pc10b-p_firmware 1.11
  • jtekt nano_cpu_firmware 2.08

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-180-04 updated cvss 6.5

JTEKT TOYOPUC PLC

  • JTEKT Corporation 2PORT-EFR JTEKT Corporation FL/ET-T-V2H JTEKT Corporation Nano 2ET JTEKT Corporation Nano 10GX JTEKT Corporation Nano CPU JTEKT Corporation PC10B
    +16 more products
    JTEKT Corporation PC10B-P JTEKT Corporation PC10E JTEKT Corporation PC10G-CPU JTEKT Corporation PC10GE JTEKT Corporation PC10P JTEKT Corporation PC10P-DP JTEKT Corporation PC10P-DP-IO JTEKT Corporation PC10PE JTEKT Corporation PC10PE-16/16P JTEKT Corporation Plus 2P-EFR JTEKT Corporation Plus BUS-EX JTEKT Corporation Plus CPU JTEKT Corporation Plus EFR JTEKT Corporation Plus EFR2 JTEKT Corporation Plus EX JTEKT Corporation Plus EX2
    affected: vendor fix, mitigation “PC10G-CPU: Versions 3.91 or later” form.k3r.jp

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

  • n/a JTEKT Corporation TOYOPUC PLC

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-787 Out-of-bounds Write

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.