High severity · published Apr 19, 2021
CVE-2021-27458
If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TCC-6464: All versions, PC10P TCC-6372:…
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TCC-6464: All versions, PC10P TCC-6372: All versions, PC10P-DP TCC-6726: All versions, PC10P-DP-IO TCC-6752: All versions, PC10B-P TCC-6373: All versions, PC10B TCC-1021: All versions, PC10B-E/C TCU-6521: All versions, PC10E TCC-4737: All versions; TOYOPUC-Plus Series: Plus CPU TCC-6740: All versions, Plus EX TCU-6741: All versions, Plus EX2 TCU-6858: All versions, Plus EFR TCU-6743: All versions, Plus EFR2 TCU-6859: All versions, Plus 2P-EFR TCU-6929: All versions, Plus BUS-EX TCU-6900: All versions; TOYOPUC-PC3J/PC2J Series: FL/ET-T-V2H THU-6289: All versions, 2PORT-EFR THU-6404: All versions) are left in an open state by an attacker, Ethernet communications cannot be established with other devices, depending on the settings of the link parameters.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2T
2port-efr Thu-6404 Firmware · Jtekt
All versions, or not specified · source: NVD
FT
Fl/et-t-v2h Thu-6289 Firmware · Jtekt
All versions, or not specified · source: NVD
PT
Pc10b Tcc-1021 Firmware · Jtekt
All versions, or not specified · source: NVD
PT
Pc10b-e/c Tcu-6521 Firmware · Jtekt
All versions, or not specified · source: NVD
PT
Pc10b-p Tcc-6373 Firmware · Jtekt
All versions, or not specified · source: NVD
PT
Pc10e Tcc-4737 Firmware · Jtekt
All versions, or not specified · source: NVD
PT
Pc10g-cpu Tcc-6353 Firmware · Jtekt
All versions, or not specified · source: NVD
PT
Pc10ge Tcc-6464 Firmware · Jtekt
All versions, or not specified · source: NVD
PT
Pc10p Tcc-6372 Firmware · Jtekt
All versions, or not specified · source: NVD
PT
Pc10p-dp Tcc-6726 Firmware · Jtekt
All versions, or not specified · source: NVD
PT
Pc10p-dp-io Tcc-6752 Firmware · Jtekt
All versions, or not specified · source: NVD
P2
Plus 2p-efr Tcu-6929 Firmware · Jtekt
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27458
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27458
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-103-03
More from 2port-efr Thu-6404 Firmware
4.3
CVE-2021-33011
All versions of the afffected TOYOPUC-PC10 Series,TOYOPUC-Plus Series,TOYOPUC-PC3J/PC2J Series, TOYOPUC-Nano Series products may not be able to properly process an ICMP flood,…
