CVE-2021-27477
📋 TL;DR
This vulnerability in JTEKT Corporation TOYOPUC PLCs allows an attacker to cause a denial of service by sending specially crafted invalid frames to the FL-net interface. When exploited, it overwrites memory outside the receive buffer, triggering a system error that stops the PLC. This affects industrial control systems using these specific PLC models.
💻 Affected Systems
- PC10G-CPU
- 2PORT-EFR
- Plus CPU
- Plus EX
- Plus EX2
- Plus EFR
- Plus EFR2
- Plus 2P-EFR
- PC10P-DP
- PC10P-DP-IO
- Plus BUS-EX
- Nano 10GX
- Nano 2ET
- PC10PE
- PC10PE-16/16P
- PC10E
- FL/ET-T-V2H
- PC10B
- PC10B-P
- Nano CPU
- PC10P
- PC10GE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete PLC shutdown causing production stoppage, safety system failures, or process disruption in critical infrastructure.
Likely Case
PLC CPU detects system error and stops operation, halting the controlled industrial process until manual restart.
If Mitigated
If network segmentation and access controls are properly implemented, the vulnerability may be unreachable by attackers.
🎯 Exploit Status
Exploitation requires sending specially crafted invalid frames to the FL-net interface. No authentication required if network access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact JTEKT for specific firmware updates
Vendor Advisory: https://us-cert.cisa.gov/ics/advisories/icsa-21-180-04
Restart Required: Yes
Instructions:
1. Contact JTEKT Corporation for firmware updates
2. Schedule maintenance window for PLC update
3. Backup PLC program and configuration
4. Apply firmware update following vendor instructions
5. Restart PLC and verify operation
🔧 Temporary Workarounds
Network Segmentation
allIsolate PLC network from other networks using firewalls or VLANs
Access Control Lists
allImplement strict network access controls to limit communication to PLC FL-net interface
🧯 If You Can't Patch
- Implement network segmentation to isolate PLCs from untrusted networks
- Deploy intrusion detection systems to monitor for malicious FL-net traffic
🔍 How to Verify
Check if Vulnerable:
Check PLC model and firmware version against affected products list. Monitor for system error logs indicating buffer overflow.Check Version:
Use PLC programming software or HMI to check firmware version (vendor-specific command)Verify Fix Applied:
Verify firmware version has been updated to patched version. Test by monitoring PLC operation during normal FL-net communication.📡 Detection & Monitoring
Log Indicators:
- PLC system error logs
- Unexpected PLC restarts
- FL-net communication errors
Network Indicators:
- Malformed FL-net packets
- Unexpected traffic to PLC FL-net port
SIEM Query:
source="plc_logs" AND ("system error" OR "buffer overflow" OR "FL-net error")