WEIDMUELLER: WLAN devices affected by improper access control vulnerability

8.8 CVSS

Vulnerability Description

In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iw_webs account settings functionality. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as that user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-33538

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://cert.vde.com/en-us/advisories/vde-2021-026

More from Weidmüller

View All →

CVE-2021-33539

WEIDMUELLER: WLAN devices affected by authentication bypass vulnerability

High 7.2

CVE-2021-33537

WEIDMUELLER: WLAN devices affected by Remote Code Execution (RCE) vulnerability

High 8.8

CVE-2021-33536

WEIDMUELLER: WLAN devices affected by Denial-of-Service vulnerability

High 7.5

CVE-2021-33535

WEIDMUELLER: WLAN devices affected by exploitable format string vulnerability

High 8.8

CVE-2021-33534

WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability

High 7.2

Affected Vendor

Weidmüller

View all reports →

Affected Software

IE-WL(T)-BL-AP-CL-XX, IE-WL(T)-VL-AP-CL-XX

Vulnerable Versions:

IE-WL-BL-AP-CL-EU (2536600000), IE-WLT-BL-AP-CL-EU (2536650000), IE-WL-BL-AP-CL-US (2536660000), IE-WLT-BL-AP-CL-US (2536670000), IE-WL-VL-AP-BR-CL-EU (2536680000), IE-WLT-VL-AP-BR-CL-EU (2536690000), IE-WL-VL-AP-BR-CL-US (2536700000), IE-WLT-VL-AP-BR-CL-US (2536710000)