PT-2022-10321 · Ultimaker · Ultimaker S5+1

Published 2022-01-10 · Updated 2022-01-14 · CVE-2021-34087

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ultimaker S3 3D printer versions prior to 6.3 Ultimaker S5 3D printer versions prior to 6.3 Ultimaker 3 3D printer S-line versions prior to 6.3 Ultimaker 3 3D printer versions prior to 5.2.16

Description The issue allows the local webserver to be used for clickjacking, which includes the settings page.

Recommendations For Ultimaker S3 3D printer versions prior to 6.3, update to version 6.3 or later. For Ultimaker S5 3D printer versions prior to 6.3, update to version 6.3 or later. For Ultimaker 3 3D printer S-line versions prior to 6.3, update to version 6.3 or later. For Ultimaker 3 3D printer versions prior to 5.2.16, update to version 5.2.16 or later.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2021-34087

Affected Products

Ultimaker S3

Ultimaker S5

References · 5

• https://ultimaker.com/3d-printers/ultimaker-s5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34087 · Security Note
• https://ultimaker.com/3d-printers/ultimaker-s3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34087 · Vendor Advisory
• https://kth.diva-portal.org/smash/get/diva2:1623489/FULLTEXT01.pdf · Note