IDEC PLC Vulnerabilities: Cleartext Sensitive Info & Predictable IDs (CVE-2024-41927/CVE-2024-28957)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: JVN#96959731 2. Affected Products: - FC6A Series MICROSmart All-in-One CPU module Ver.2.60 and earlier - FC6B Series MICROSmart All-in-One CPU module Ver.2.60 and earlier - FC6A Series MICROSmart Plus CPU module Ver.2.40 and earlier - FC6B Series MICROSmart Plus CPU module Ver.2.60 and earlier - FT1A Series SmartAXIS Pro/Lite Ver.2.41 and earlier 3. Vulnerability Description: - CWE-319: Transmission of Sensitive Information in Plain Text - CWE-340: Generation of Predictable Identifiers 4. Impact: - Attackers can obtain PLC authentication information via specific commands, potentially gaining access to PLC programs and causing unintended operations (CVE-2024-41927) - Unauthorized attackers can disrupt communication by predicting the header ID of PLC communication packets (CVE-2024-28957) 5. Solution: - Update system software to the latest version (as instructed by the vendor) - Updated versions include: - FC6A Series MICROSmart All-in-One CPU module Ver.2.70 - FC6B Series MICROSmart All-in-One CPU module Ver.2.70 - FC6A Series MICROSmart Plus CPU module Ver.2.50 - FC6B Series MICROSmart Plus CPU module Ver.2.70 - FT1A Series SmartAXIS Pro/Lite Ver.2.50 6. Reference Links: - IDEC Corporation’s vulnerability report on plaintext transmission of sensitive information and use of predictable IDs (PDF) - JPCERT/CC vulnerability analysis report - JPCERT/CC vulnerability advisory - Other related links, such as CVE numbers, JVN iPedia, etc. This information helps users understand the detailed nature of the vulnerability, the scope of affected products, the potential impact, the recommended solutions, and relevant reference resources.

Goal Reached Thanks to every supporter — we hit 100%!

IDEC PLC Vulnerabilities: Cleartext Sensitive Info & Predictable IDs (CVE-2024-41927/CVE-2024-28957)