CVE-2021-37401

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC user program may be uploaded, altered, and/or downloaded.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://jvn.jp/en/vu/JVNVU92279973/Third Party Advisory
https://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6AVendor Advisory
https://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-OrganizerVendor Advisory
https://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdfVendor Advisory
https://jvn.jp/en/vu/JVNVU92279973/Third Party Advisory
https://us.idec.com/idec-us/en/USD/Programmable-Logic-Controller/Micro-PLC/FC6A-MicroSmart/c/MicroSmart_FC6AVendor Advisory
https://us.idec.com/idec-us/en/USD/Software-Downloads-Automation-OrganizerVendor Advisory
https://www.idec.com/home/lp/pdf/2021-12-24-PLC.pdfVendor Advisory

Timeline

Published: Dec 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-374026.1OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval CVE-2021-374036.1OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link i CVE-2021-374049.8There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may CVE-2021-374097.8Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enabl CVE-2021-37415.4A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerabilit CVE-2021-374126.1The TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar.CVE-2021-374139.8GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploi CVE-2021-374147.5Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication.CVE-2021-374159.8Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authenticatio CVE-2021-374166.1Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.CVE-2021-374179.8Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.CVE-2021-374197.5Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.