CVE-2021-33533

Published: Jun 25, 2021Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted iw_serverip parameter can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.

Affected (16)

Products: Weidmueller: Ie Wl Bl Ap Cl Eu Firmware, Ie Wlt Bl Ap Cl Eu Firmware, Ie Wl Bl Ap Cl Us Firmware, Ie Wlt Bl Ap Cl Us Firmware, Ie Wl Vl Ap Br Cl Eu Firmware, Ie Wlt Vl Ap Br Cl Eu Firmware, Ie Wl Vl Ap Br Cl Us Firmware, Ie Wlt Vl Ap Br Cl Us Firmware

Weidmueller

8 products

Ie Wl Bl Ap Cl Eu Firmware

Ie Wlt Bl Ap Cl Eu Firmware

Ie Wl Bl Ap Cl Us Firmware

Ie Wlt Bl Ap Cl Us Firmware

Ie Wl Vl Ap Br Cl Eu Firmware

Ie Wlt Vl Ap Br Cl Eu Firmware

Ie Wl Vl Ap Br Cl Us Firmware

Ie Wlt Vl Ap Br Cl Us Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Bl Ap Cl Eu Firmware	Up to 1.16.18

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Bl Ap Cl Eu Firmware	Up to 1.16.18

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Bl Ap Cl Us Firmware	Up to 1.16.18

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Bl Ap Cl Us Firmware	Up to 1.16.18

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Vl Ap Br Cl Eu Firmware	Up to 1.16.18

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Vl Ap Br Cl Eu Firmware	Up to 1.16.18

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Vl Ap Br Cl Us Firmware	Up to 1.16.18

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Vl Ap Br Cl Us Firmware	Up to 1.16.18

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Bl Ap Cl Eu Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wl Bl Ap Cl Eu	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Bl Ap Cl Eu Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wlt Bl Ap Cl Eu	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Bl Ap Cl Us Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wl Bl Ap Cl Us	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Bl Ap Cl Us Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wlt Bl Ap Cl Us	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Vl Ap Br Cl Eu Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wl Vl Ap Br Cl Eu	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Vl Ap Br Cl Eu Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wlt Vl Ap Br Cl Eu	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wl Vl Ap Br Cl Us Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wl Vl Ap Br Cl Us	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weidmueller Ie Wlt Vl Ap Br Cl Us Firmware	Up to 1.11.10

Running on/with	Platform Versions
Weidmueller Ie Wlt Vl Ap Br Cl Us	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://cert.vde.com/en-us/advisories/vde-2021-026

Source: info@cert.vde.com

Third Party Advisory

https://cert.vde.com/en-us/advisories/vde-2021-026

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.