High severity · published Jun 25, 2021
CVE-2021-33534
In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality
7.2
CVSS
2.1%
EPSS
No
On KEV
Description
In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send various requests while authenticated as a high privilege user to trigger this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Ie-wl-bl-ap-cl-eu Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wl-bl-ap-cl-us Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wl-vl-ap-br-cl-eu Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wl-vl-ap-br-cl-us Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wlt-bl-ap-cl-eu Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wlt-bl-ap-cl-us Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wlt-vl-ap-br-cl-eu Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
IF
Ie-wlt-vl-ap-br-cl-us Firmware · Weidmueller
through 1.16.18; through 1.11.10 · source: NVD
Affected product
IF
Ie-wl-bl-ap-cl-eu Firmware
Weidmueller
More from Ie-wl-bl-ap-cl-eu Firmware
8.8
CVE-2021-33538
In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iw_webs account settings functionality
8.8
CVE-2021-33537
In Weidmueller Industrial WLAN devices in multiple versions an exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality
8.8
CVE-2021-33535
In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iw_console conio_writestr functionality
8.8
CVE-2021-33533
In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality
8.8
CVE-2021-33532
In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality