CVE-2021-27477 Memory corruption in JTEKT Corporation TOYOPUC PLC
An attacker can cause a denial of service by sending invalid frames to JTEKT TOYOPUC PLCs, triggering a buffer overflow that stops the CPU.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27477?
CVE-2021-27477 is a high-severity memory corruption vulnerability in JTEKT Corporation TOYOPUC PLC, published on 1 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When JTEKT Corporation TOYOPUC PLC versions PC10G-CPU, 2PORT-EFR, Plus CPU, Plus EX, Plus EX2, Plus EFR, Plus EFR2, Plus 2P-EFR, PC10P-DP, PC10P-DP-IO, Plus BUS-EX, Nano 10GX, Nano 2ET,PC10PE, PC10PE-16/16P, PC10E, FL/ET-T-V2H, PC10B,PC10B-P, Nano CPU, PC10P, and PC10GE receive an invalid frame, the outside area of a receive buffer for FL-net are overwritten. As a result, the PLC CPU detects a system error, and the affected products stop.
Which versions are affected by CVE-2021-27477?
It affects 22 products.
Products include Jtekt 2port-Efr Firmware, Jtekt Fl\/Et-T-V2h Firmware, Jtekt Nano 10gx Firmware, Jtekt Nano 2et Firmware, Jtekt Nano Cpu Firmware, Jtekt Pc10b-P Firmware and 16 more.
How do I fix CVE-2021-27477?
No fix has been published for CVE-2021-27477 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-27477 being exploited?
There is no known exploitation of CVE-2021-27477 in the wild and no public exploit code.
Sources
Also known as GHSA-xqpg-rjjg-58q9.