CVE-2024-41927 Information disclosure in FC6A Series MICROSmart All-in-One CPU module
Attackers can obtain user credentials via cleartext transmission on serial ports, leading to PLC program theft and manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41927?
CVE-2024-41927 is a medium-severity vulnerability in IDEC Corporation FC6A Series MICROSmart All-in-One CPU module, published on 4 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communication port, user credentials may be obtained. As a result, the program of the PLC may be obtained, and the PLC may be manipulated.
Weakness: CWE-319
Which versions are affected by CVE-2024-41927?
It affects 91 products.
Products include Idec Ft1a-B12ra Firmware, Idec Ft1a-B24ra Firmware, Idec Ft1a-H12ra Firmware, Idec Ft1a-H12rc Firmware, Idec Ft1a-H24ra Firmware, Idec Ft1a-H24rc Firmware and 85 more.
How do I fix CVE-2024-41927?
No fix has been published for CVE-2024-41927 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-41927 being exploited?
There is no known exploitation of CVE-2024-41927 in the wild and no public exploit code.
Sources
Also known as GHSA-q4gj-2fgv-hpxf.