How severe is CVE-2021-27458?

CVE-2021-27458 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2021-27458 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-27458?

CVE-2021-27458 primarily affects Jtekt Pc10g-cpu Tcc-6353 Firmware. In total, 18 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-27458?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2021-27458 published?

CVE-2021-27458 was published on 2021-04-19 and last updated on 2026-06-17.

CVE-2021-27458

CVE-2021-27458 is a high-severity vulnerability in Jtekt Pc10g-cpu Tcc-6353 Firmware with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-404.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 1% (62nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-404
Affected product: Jtekt Pc10g-cpu Tcc-6353 Firmware
Published: 2021-04-19
Last modified: 2026-06-17

Description

If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TCC-6464: All versions, PC10P TCC-6372: All versions, PC10P-DP TCC-6726: All versions, PC10P-DP-IO TCC-6752: All versions, PC10B-P TCC-6373: All versions, PC10B TCC-1021: All versions, PC10B-E/C TCU-6521: All versions, PC10E TCC-4737: All versions; TOYOPUC-Plus Series: Plus CPU TCC-6740: All versions, Plus EX TCU-6741: All versions, Plus EX2 TCU-6858: All versions, Plus EFR TCU-6743: All versions, Plus EFR2 TCU-6859: All versions, Plus 2P-EFR TCU-6929: All versions, Plus BUS-EX TCU-6900: All versions; TOYOPUC-PC3J/PC2J Series: FL/ET-T-V2H THU-6289: All versions, 2PORT-EFR THU-6404: All versions) are left in an open state by an attacker, Ethernet communications cannot be established with other devices, depending on the settings of the link parameters.

Frequently asked questions

What is CVE-2021-27458?: If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TCC-6464: All versions, PC10P TCC-6372: All versions, PC10P-DP TCC-6726: All versions, PC10P-DP-IO TCC-6752: All versions, PC10B-P TCC-6373: All versions, PC10B TCC-1021: All versions, PC10B-E/C TCU-6521: All versions, PC10E TCC-4737: All versions; TOYOPUC-Plus Series: Plus CPU TCC-6740: All versions, Plus EX TCU-6741: All versions, Plus EX2 TCU-6858: All versions, Plus EFR TCU-6743: All versions, Plus EFR2 TCU-6859: All versions, Plus 2P-EFR TCU-6929: All versions, Plus BUS-EX TCU-6900: All versions; TOYOPUC-PC3J/PC2J Series: FL/ET-T-V2H THU-6289: All versions, 2PORT-EFR THU-6404: All versions) are left in an open state by an attacker, Ethernet communications cannot be established with other devices, depending on the settings of the link parameters.
How severe is CVE-2021-27458?: CVE-2021-27458 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2021-27458 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (62nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-27458?: CVE-2021-27458 primarily affects Jtekt Pc10g-cpu Tcc-6353 Firmware. In total, 18 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-27458?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2021-27458 published?: CVE-2021-27458 was published on 2021-04-19 and last updated on 2026-06-17.

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-103-03

Affected products (18)

cpe:2.3:o:jtekt:pc10g-cpu_tcc-6353_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:pc10ge_tcc-6464_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:pc10p_tcc-6372_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:pc10p-dp_tcc-6726_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:pc10p-dp-io_tcc-6752_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:pc10b-p_tcc-6373_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:pc10b_tcc-1021_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:pc10b-e\/c_tcu-6521_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:pc10e_tcc-4737_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:plus_cpu_tcc-6740_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:plus_ex_tcu-6741_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:plus_ex2_tcu-6858_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:plus_efr_tcu-6743_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:plus_efr2_tcu-6859_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:plus_2p-efr_tcu-6929_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:plus_bus-ex_tcu-6900_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:fl\/et-t-v2h_thu-6289_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:jtekt:2port-efr_thu-6404_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Jtekt Pc10g-cpu Tcc-6353 Firmware

CVE-2022-29958 — Critical (CVSS 9.8): JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP…
CVE-2022-29951 — Critical (CVSS 9.1): JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on…
CVE-2021-33011 — Medium (CVSS 4.3): All versions of the afffected TOYOPUC-PC10 Series,TOYOPUC-Plus Series,TOYOPUC-PC3J/PC2J Series, TOYOPUC-Nano Series…

All CVEs affecting Jtekt Pc10g-cpu Tcc-6353 Firmware →

Other CWE-404 vulnerabilities

CVE-2023-24444 — Critical (CVSS 9.8): Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
CVE-2024-31611 — Critical (CVSS 9.1): SeaCMS 12.9 has a file deletion vulnerability via admin_template.php.
CVE-2018-8450 — High (CVSS 8.8): A remote code execution vulnerability exists when Windows Search handles objects in memory, aka "Windows Search Remote…
CVE-2026-11317 — High (CVSS 8.7): A denial of service security issue exists in the affected product. The security issue stems from a fault occurring when…
CVE-2022-25762 — High (CVSS 8.6): If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on…
CVE-2020-26070 — High (CVSS 8.6): A vulnerability in the ingress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series…

Browse all CWE-404 vulnerabilities →