High severity · published Jun 25, 2021
CVE-2021-33529
In Weidmueller Industrial WLAN devices in multiple versions the usage of hard-coded cryptographic keys within the service agent binary allows for the decryption of captured…
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
In Weidmueller Industrial WLAN devices in multiple versions the usage of hard-coded cryptographic keys within the service agent binary allows for the decryption of captured traffic across the network from or to the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Ie-wl-bl-ap-cl-eu Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wl-bl-ap-cl-us Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wl-vl-ap-br-cl-eu Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wl-vl-ap-br-cl-us Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wlt-bl-ap-cl-eu Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wlt-bl-ap-cl-us Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wlt-vl-ap-br-cl-eu Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wlt-vl-ap-br-cl-us Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33529
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33529
Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2021-026
More from Ie-wl-bl-ap-cl-eu Firmware
8.8
CVE-2021-33538
In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iw_webs account settings functionality
8.8
CVE-2021-33537
In Weidmueller Industrial WLAN devices in multiple versions an exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality
8.8
CVE-2021-33535
In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iw_console conio_writestr functionality
8.8
CVE-2021-33533
In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality
8.8
CVE-2021-33532
In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality