Is CVE-2021-20826 actively exploited?

No active exploitation of CVE-2021-20826 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-20826 be exploited remotely?

Partially. CVE-2021-20826 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2021-20826?

CVE-2021-20826 has a CVSS score of 7.6 (HIGH).

HOME VULNERABILITIESCVE-2021-20826

HIGH

CVE-2021-20826

CWE-522Published: December 24, 2021· Updated: Jun 17, 2026

7.6

CVSS v3.1

Official Description

Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and earlier, WindLDR v8.19.1 and earlier, WindEDIT Lite v1.3.1 and earlier, and Data File Manager v2.12.1 and earlier) allows an attacker to obtain the PLC Web server user credentials from the communication between the PLC and the software. As a result, the complete access privileges to the PLC Web server may be obtained, and manipulation of the PLC output and/or suspension of the PLC may be conducted.

NVD Source

Technical Analysis

CVE-2021-20826 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.6.