CVE-2021-33528

Published: Jun 25, 2021Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iw_console functionality. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.

Affected (16)

Products: Weidmueller: Ie Wl Bl Ap Cl Eu Firmware, Ie Wlt Bl Ap Cl Eu Firmware, Ie Wl Bl Ap Cl Us Firmware, Ie Wlt Bl Ap Cl Us Firmware, Ie Wl Vl Ap Br Cl Eu Firmware, Ie Wlt Vl Ap Br Cl Eu Firmware, Ie Wl Vl Ap Br Cl Us Firmware, Ie Wlt Vl Ap Br Cl Us Firmware

Weidmueller

8 products

Ie Wl Bl Ap Cl Eu Firmware

Ie Wlt Bl Ap Cl Eu Firmware

Ie Wl Bl Ap Cl Us Firmware

Ie Wlt Bl Ap Cl Us Firmware

Ie Wl Vl Ap Br Cl Eu Firmware

Ie Wlt Vl Ap Br Cl Eu Firmware

Ie Wl Vl Ap Br Cl Us Firmware

Ie Wlt Vl Ap Br Cl Us Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Bl Ap Cl Eu Firmware	Up to 1.16.18

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Bl Ap Cl Eu Firmware	Up to 1.16.18

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Bl Ap Cl Us Firmware	Up to 1.16.18

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Bl Ap Cl Us Firmware	Up to 1.16.18

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Vl Ap Br Cl Eu Firmware	Up to 1.16.18

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Vl Ap Br Cl Eu Firmware	Up to 1.16.18

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Vl Ap Br Cl Us Firmware	Up to 1.16.18

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Vl Ap Br Cl Us Firmware	Up to 1.16.18

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Bl Ap Cl Eu Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wl Bl Ap Cl Eu	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Bl Ap Cl Eu Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wlt Bl Ap Cl Eu	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Bl Ap Cl Us Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wl Bl Ap Cl Us	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Bl Ap Cl Us Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wlt Bl Ap Cl Us	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Vl Ap Br Cl Eu Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wl Vl Ap Br Cl Eu	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Vl Ap Br Cl Eu Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wlt Vl Ap Br Cl Eu	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Vl Ap Br Cl Us Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wl Vl Ap Br Cl Us	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Vl Ap Br Cl Us Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wlt Vl Ap Br Cl Us	All versions

Related CWEs

CWE-710

Improper Adherence to Coding Standards

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

References (2)

https://cert.vde.com/en-us/advisories/vde-2021-026

Source: info@cert.vde.com

Third Party Advisory

https://cert.vde.com/en-us/advisories/vde-2021-026

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.