CVE-2021-33538
Assigner: CERTVDE
Published: 2021-06-23T00:00:00
State: PUBLISHED
affected: product: IE-WL(T)-BL-AP-CL-XX
vendor: Weidmüller
versions: lessThanOrEqual: V1.16.18 (Build 18081617)
status: affected
version: IE-WL-BL-AP-CL-EU (2536600000)
versionType: custom
lessThanOrEqual: V1.16.18 (Build 18081617)
status: affected
version: IE-WLT-BL-AP-CL-EU (2536650000)
versionType: custom
lessThanOrEqual: V1.16.18 (Build 18081617)
status: affected
version: IE-WL-BL-AP-CL-US (2536660000)
versionType: custom
lessThanOrEqual: V1.16.18 (Build 18081617)
status: affected
version: IE-WLT-BL-AP-CL-US (2536670000)
versionType: custom
product: IE-WL(T)-VL-AP-CL-XX
vendor: Weidmüller
versions: lessThanOrEqual: V1.11.10 (Build 18122616)
status: affected
version: IE-WL-VL-AP-BR-CL-EU (2536680000)
versionType: custom
lessThanOrEqual: V1.11.10 (Build 18122616)
status: affected
version: IE-WLT-VL-AP-BR-CL-EU (2536690000)
versionType: custom
lessThanOrEqual: V1.11.10 (Build 18122616)
status: affected
version: IE-WL-VL-AP-BR-CL-US (2536700000)
versionType: custom
lessThanOrEqual: V1.11.10 (Build 18122616)
status: affected
version: IE-WLT-VL-AP-BR-CL-US (2536710000)
versionType: custom
datePublic: 2021-06-23T00:00:00
descriptions: value: In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iw_webs account settings functionality. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as that user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-269
description: CWE-269 Improper Privilege Management
type: CWE
solutions: value: For IE-WL(T)-BL-AP-CL-XX versions V1.16.21 (Build 21010513) and greater are fixed.
For IE-WL(T)-VL-AP-CL-XX versions V1.11.13 (Build 21010513) and greater are fixed.
source: advisory: VDE-2021-026
defect: VDE-2021-026
discovery: EXTERNAL
title: WEIDMUELLER: WLAN devices affected by improper access control vulnerability
x_generator: engine: Vulnogram 0.0.9