PT-2021-20185 · Weidmueller · Weidmueller Industrial Wlan

Published 2021-06-25 · Updated 2022-10-25 · CVE-2021-33538

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Weidmueller Industrial WLAN devices (affected versions not specified)

Description The issue concerns an improper access control vulnerability in the account settings functionality of the device. Specifically, it affects the iw webs account settings. A specially crafted username entry can lead to the overwrite of an existing user account password, allowing remote shell access to the device as that user. An attacker, authenticated as a low-privilege user, can trigger this issue by sending specific commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-33538

Affected Products

Weidmueller Industrial Wlan

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-33538 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33538 · Vendor Advisory
• https://t.me/cvenotify/16757 · Telegram Post
• https://cert.vde.com/en-us/advisories/vde-2021-026 · Note
• https://t.me/cvenotify/16914 · Telegram Post