CVE-2021-27477
When JTEKT Corporation TOYOPUC PLC versions PC10G-CPU, 2PORT-EFR, Plus CPU, Plus EX, Plus EX2, Plus EFR, Plus EFR2, Plus 2P-EFR, PC10P-DP, PC10P-DP-IO, Plus BUS-EX, Nano 10GX, Nano 2ET,PC10PE, PC10PE-16/16P, PC10E, FL/ET-T-V2H, PC10B,PC10B-P, Nano CPU,…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
When JTEKT Corporation TOYOPUC PLC versions PC10G-CPU, 2PORT-EFR, Plus CPU, Plus EX, Plus EX2, Plus EFR, Plus EFR2, Plus 2P-EFR, PC10P-DP, PC10P-DP-IO, Plus BUS-EX, Nano 10GX, Nano 2ET,PC10PE, PC10PE-16/16P, PC10E, FL/ET-T-V2H, PC10B,PC10B-P, Nano CPU, PC10P, and PC10GE receive an invalid frame, the outside area of a receive buffer for FL-net are overwritten. As a result, the PLC CPU detects a system error, and the affected products stop.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.13% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119, CWE-787
- Affected
- jtekt/pc10g-cpu firmware · jtekt/2port-efr firmware · jtekt/plus cpu firmware · jtekt/plus ex firmware · jtekt/plus ex2 firmware · jtekt/plus efr firmware · jtekt/plus efr2 firmware · jtekt/plus 2p-efr firmware · jtekt/pc10p-dp firmware · jtekt/pc10p-dp-io firmware · jtekt/plus bus-ex firmware · jtekt/nano 10gx firmware · jtekt/nano 2et firmware · jtekt/pc10pe firmware · jtekt/pc10pe-16\/16p firmware · jtekt/pc10e firmware · jtekt/fl\/et-t-v2h firmware · jtekt/pc10b firmware · jtekt/pc10b-p firmware · jtekt/nano cpu firmware · +2 more
- Source
- ics-cert@hq.dhs.gov
References
- https://us-cert.cisa.gov/ics/advisories/icsa-21-180-04Third Party Advisory, US Government Resource
- https://us-cert.cisa.gov/ics/advisories/icsa-21-180-04Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.