PT-2022-10320 · Ultimaker · Ultimaker S5+1

Published 2022-01-10 · Updated 2022-01-14 · CVE-2021-34086

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ultimaker S3 3D printer versions through 6.3 Ultimaker S5 3D printer versions through 6.3 Ultimaker 3 3D printer S-line versions through 6.3 Ultimaker 3 versions through 5.2.16

Description The local webserver in the affected 3D printers hosts APIs that are vulnerable to CSRF attacks because they do not verify incoming requests.

Recommendations For Ultimaker S3 3D printer versions through 6.3, update to a version that includes a fix for this issue. For Ultimaker S5 3D printer versions through 6.3, update to a version that includes a fix for this issue. For Ultimaker 3 3D printer S-line versions through 6.3, update to a version that includes a fix for this issue. For Ultimaker 3 versions through 5.2.16, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the vulnerable APIs until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-34086

Affected Products

Ultimaker S3

Ultimaker S5

References · 7

• https://ultimaker.com/3d-printers/ultimaker-s5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34086 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34086 · Security Note
• https://ultimaker.com/3d-printers/ultimaker-3 · Vendor Advisory
• https://ultimaker.com/3d-printers/ultimaker-s3 · Vendor Advisory
• https://t.me/cibsecurity/35154 · Telegram Post
• https://kth.diva-portal.org/smash/get/diva2:1623489/FULLTEXT01.pdf · Note