CVE-2024-41927

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. If an attacker sends a specific command to PLC's serial communication port, user credentials may be obtained. As a result, the program of the PLC may be obtained, and the PLC may be manipulated.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
IDEC Corporation	FC6A Series MICROSmart All-in-One CPU module	Ver.2.60 and earlier
IDEC Corporation	FC6B Series MICROSmart All-in-One CPU module	Ver.2.60 and earlier
IDEC Corporation	FC6A Series MICROSmart Plus CPU module	Ver.2.40 and earlier
IDEC Corporation	FC6B Series MICROSmart Plus CPU module	Ver.2.60 and earlier
IDEC Corporation	FT1A Series SmartAXIS Pro/Lite	Ver.2.41 and earlier

References

https://jvn.jp/en/vu/JVNVU96959731/Third Party Advisory
https://us.idec.com/media/24-RD-0256-EN-b.pdf

Timeline

Published: Sep 4, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-419288.4Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace proces CVE-2024-419298.8Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authent CVE-2024-41936.4The Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'testimonialcategory' shortcode in all vers CVE-2024-419306.1Cross-site scripting vulnerability exists in MF Teacher Performance Management System version 6. If this vulnerability is exploited, an arbi CVE-2024-419314.3The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. It is CVE-2024-419325.5In the Linux kernel, the following vulnerability has been resolved: sched: fix warning in sched_setaffinity Commit 8f9ea86fdf99b added som CVE-2024-419345.9Improper access control in some Intel(R) GPA software before version 2024.3 may allow an authenticated user to potentially enable denial of CVE-2024-419357.1In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to shrink read extent node in batches We use rwlock to prote CVE-2024-419367.5A directory traversal vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 CVE-2024-419376.1Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scrip CVE-2024-419383.8A vulnerability has been identified in SINEC NMS (All versions < V3.0). The importCertificate function of the SINEC NMS Control web applicat CVE-2024-419398.8A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization che