CVE-2021-33538: WEIDMUELLER: WLAN devices affected by improper access control vulnerability
In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iwwebs account settings functionality. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as that user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-33538?
CVE-2021-33538 is a vulnerability in Weidmueller Industrial WLAN devices that allows improper access control, resulting in remote shell access.
How severe is CVE-2021-33538?
CVE-2021-33538 has a severity score of 8.8, which is categorized as critical.
Which Weidmueller Industrial WLAN devices are affected by CVE-2021-33538?
Multiple versions of Weidmueller Industrial WLAN devices including Weidmueller Ie-wl-bl-ap-cl-eu, Weidmueller Ie-wlt-bl-ap-cl-eu, Weidmueller Ie-wl-bl-ap-cl-us, Weidmueller Ie-wlt-bl-ap-cl-us, Weidmueller Ie-wl-vl-ap-br-cl-eu, Weidmueller Ie-wlt-vl-ap-br-cl-eu, Weidmueller Ie-wl-vl-ap-br-cl-us, and Weidmueller Ie-wlt-vl-ap-br-cl-us are affected.
What is the vulnerability in Weidmueller Industrial WLAN devices?
The vulnerability in Weidmueller Industrial WLAN devices is an improper access control vulnerability in the iw_webs account settings functionality.
How can I fix the vulnerability in Weidmueller Industrial WLAN devices?
To fix the vulnerability in Weidmueller Industrial WLAN devices, it is recommended to update to a version that includes a fix for CVE-2021-33538.