Log in Start free

Vulnerability · Published Jun 25, 2021 · Assigned by CERTVDE

CVE-2021-33531WEIDMUELLER: WLAN devices affected by Hard-coded Credentials vulnerability

High 8.8

In plain English

A high-severity hard-coded credentials in IE-WL(T)-BL-AP-CL-XX from Weidmüller. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 45.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Weidmueller Industrial WLAN devices in multiple versions an exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities. The device operating system contains an undocumented encryption password, allowing for the creation of custom diagnostic scripts. An attacker can send diagnostic scripts while authenticated as a low privilege user to trigger this vulnerability.

Affected products (as reported)

VendorProductVersions
Weidmüller IE-WL(T)-BL-AP-CL-XX IE-WL-BL-AP-CL-EU (2536600000) – through V1.16.18 (Build 18081617)IE-WLT-BL-AP-CL-EU (2536650000) – through V1.16.18 (Build 18081617)IE-WL-BL-AP-CL-US (2536660000) – through V1.16.18 (Build 18081617)IE-WLT-BL-AP-CL-US (2536670000) – through V1.16.18 (Build 18081617)
Weidmüller IE-WL(T)-VL-AP-CL-XX IE-WL-VL-AP-BR-CL-EU (2536680000) – through V1.11.10 (Build 18122616)IE-WLT-VL-AP-BR-CL-EU (2536690000) – through V1.11.10 (Build 18122616)IE-WL-VL-AP-BR-CL-US (2536700000) – through V1.11.10 (Build 18122616)IE-WLT-VL-AP-BR-CL-US (2536710000) – through V1.11.10 (Build 18122616)

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References