CVE-2021-27458 Denial of service in JTEKT Corporation TOYOPUC products

High 7.5 Published 19 Apr 2021 Updated 3 Aug 2024

An attacker can cause a denial of service by leaving Ethernet communication open, preventing connections with other devices in JTEKT TOYOPUC products.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-27458?

CVE-2021-27458 is a high-severity denial of service vulnerability in JTEKT Corporation TOYOPUC products, published on 19 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TCC-6464: All versions, PC10P TCC-6372: All versions, PC10P-DP TCC-6726: All versions, PC10P-DP-IO TCC-6752: All versions, PC10B-P TCC-6373: All versions, PC10B TCC-1021: All versions, PC10B-E/C TCU-6521: All versions, PC10E TCC-4737: All versions; TOYOPUC-Plus Series: Plus CPU TCC-6740: All versions, Plus EX TCU-6741: All versions, Plus EX2 TCU-6858: All versions, Plus EFR TCU-6743: All versions, Plus EFR2 TCU-6859: All versions, Plus 2P-EFR TCU-6929: All versions, Plus BUS-EX TCU-6900: All versions; TOYOPUC-PC3J/PC2J Series: FL/ET-T-V2H THU-6289: All versions, 2PORT-EFR THU-6404: All versions) are left in an open state by an attacker, Ethernet communications cannot be established with other devices, depending on the settings of the link parameters.

Weakness: CWE-404

Which versions are affected by CVE-2021-27458?

It affects 18 products.

Products include Jtekt 2port-Efr Thu-6404 Firmware, Jtekt Fl\/Et-T-V2h Thu-6289 Firmware, Jtekt Pc10b-E\/C Tcu-6521 Firmware, Jtekt Pc10b-P Tcc-6373 Firmware, Jtekt Pc10b Tcc-1021 Firmware, Jtekt Pc10e Tcc-4737 Firmware and 12 more.

How do I fix CVE-2021-27458?

No fix has been published for CVE-2021-27458 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-27458 being exploited?

There is no known exploitation of CVE-2021-27458 in the wild and no public exploit code.

CVE-2021-33011 Denial of service in JTEKT Corporation TOYOPUC products Medium 4.3

Sources

Also known as GHSA-qmc4-q85x-pjh3.