CVE-2021-33534
Assigner: CERTVDE
Published: 2021-06-23T00:00:00
State: PUBLISHED
affected: product: IE-WL(T)-BL-AP-CL-XX
vendor: Weidmüller
versions: lessThanOrEqual: V1.16.18 (Build 18081617)
status: affected
version: IE-WL-BL-AP-CL-EU (2536600000)
versionType: custom
lessThanOrEqual: V1.16.18 (Build 18081617)
status: affected
version: IE-WLT-BL-AP-CL-EU (2536650000)
versionType: custom
lessThanOrEqual: V1.16.18 (Build 18081617)
status: affected
version: IE-WL-BL-AP-CL-US (2536660000)
versionType: custom
lessThanOrEqual: V1.16.18 (Build 18081617)
status: affected
version: IE-WLT-BL-AP-CL-US (2536670000)
versionType: custom
product: IE-WL(T)-VL-AP-CL-XX
vendor: Weidmüller
versions: lessThanOrEqual: V1.11.10 (Build 18122616)
status: affected
version: IE-WL-VL-AP-BR-CL-EU (2536680000)
versionType: custom
lessThanOrEqual: V1.11.10 (Build 18122616)
status: affected
version: IE-WLT-VL-AP-BR-CL-EU (2536690000)
versionType: custom
lessThanOrEqual: V1.11.10 (Build 18122616)
status: affected
version: IE-WL-VL-AP-BR-CL-US (2536700000)
versionType: custom
lessThanOrEqual: V1.11.10 (Build 18122616)
status: affected
version: IE-WLT-VL-AP-BR-CL-US (2536710000)
versionType: custom
datePublic: 2021-06-23T00:00:00
descriptions: value: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send various requests while authenticated as a high privilege user to trigger this vulnerability.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-78
description: CWE-78 OS Command Injection
type: CWE
solutions: value: For IE-WL(T)-BL-AP-CL-XX versions V1.16.21 (Build 21010513) and greater are fixed.
For IE-WL(T)-VL-AP-CL-XX versions V1.11.13 (Build 21010513) and greater are fixed.
source: advisory: VDE-2021-026
defect: VDE-2021-026
discovery: EXTERNAL
title: WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability
x_generator: engine: Vulnogram 0.0.9