Sign-up

ID

VAR-202106-1215


CVE

CVE-2021-33531


TITLE

plural  Weidmueller Industrial WLAN  Vulnerability in using hard-coded credentials on devices

Trust: 0.8

sources: JVNDB: JVNDB-2021-008526

DESCRIPTION

In Weidmueller Industrial WLAN devices in multiple versions an exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities. The device operating system contains an undocumented encryption password, allowing for the creation of custom diagnostic scripts. An attacker can send diagnostic scripts while authenticated as a low privilege user to trigger this vulnerability. Weidmueller Industrial WLAN devices is an industrial control WIAN of Weidmueller company in Germany. Weidmueller Industrial WLAN devices have a trust management vulnerability

Trust: 2.25

sources: NVD: CVE-2021-33531 // JVNDB: JVNDB-2021-008526 // CNVD: CNVD-2021-48135 // VULMON: CVE-2021-33531

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-48135

AFFECTED PRODUCTS

vendor:weidmuellermodel:ie-wlt-vl-ap-br-cl-usscope:lteversion:1.11.10

Trust: 1.0

vendor:weidmuellermodel:ie-wl-vl-ap-br-cl-usscope:lteversion:1.16.18

Trust: 1.0

vendor:weidmuellermodel:ie-wlt-vl-ap-br-cl-usscope:lteversion:1.16.18

Trust: 1.0

vendor:weidmuellermodel:ie-wl-bl-ap-cl-usscope:lteversion:1.16.18

Trust: 1.0

vendor:weidmuellermodel:ie-wl-bl-ap-cl-euscope:lteversion:1.11.10

Trust: 1.0

vendor:weidmuellermodel:ie-wlt-vl-ap-br-cl-euscope:lteversion:1.16.18

Trust: 1.0

vendor:weidmuellermodel:ie-wl-vl-ap-br-cl-euscope:lteversion:1.11.10

Trust: 1.0

vendor:weidmuellermodel:ie-wlt-vl-ap-br-cl-euscope:lteversion:1.11.10

Trust: 1.0

vendor:weidmuellermodel:ie-wlt-bl-ap-cl-euscope:lteversion:1.11.10

Trust: 1.0

vendor:weidmuellermodel:ie-wlt-bl-ap-cl-usscope:lteversion:1.11.10

Trust: 1.0

vendor:weidmuellermodel:ie-wl-bl-ap-cl-usscope:lteversion:1.11.10

Trust: 1.0

vendor:weidmuellermodel:ie-wl-bl-ap-cl-euscope:lteversion:1.16.18

Trust: 1.0

vendor:weidmuellermodel:ie-wl-vl-ap-br-cl-usscope:lteversion:1.11.10

Trust: 1.0

vendor:weidmuellermodel:ie-wl-vl-ap-br-cl-euscope:lteversion:1.16.18

Trust: 1.0

vendor:weidmuellermodel:ie-wlt-bl-ap-cl-euscope:lteversion:1.16.18

Trust: 1.0

vendor:weidmuellermodel:ie-wlt-bl-ap-cl-usscope:lteversion:1.16.18

Trust: 1.0

vendor:weidmuellermodel:ie-wlt-bl-ap-cl-euscope: - version: -

Trust: 0.8

vendor:weidmuellermodel:ie-wl-vl-ap-br-cl-euscope: - version: -

Trust: 0.8

vendor:weidmuellermodel:ie-wlt-bl-ap-cl-usscope: - version: -

Trust: 0.8

vendor:weidmuellermodel:ie-wlt-vl-ap-br-cl-euscope: - version: -

Trust: 0.8

vendor:weidmuellermodel:ie-wl-bl-ap-cl-euscope: - version: -

Trust: 0.8

vendor:weidmuellermodel:ie-wl-bl-ap-cl-usscope: - version: -

Trust: 0.8

vendor:weidmuellermodel:ie-wlt-vl-ap-br-cl-usscope: - version: -

Trust: 0.8

vendor:weidmuellermodel:ie-wl-vl-ap-br-cl-usscope: - version: -

Trust: 0.8

vendor:weidmuellermodel:ie-wl-bl-ap-cl-us (buildscope:lteversion:<=v1.16.1818081617)

Trust: 0.6

vendor:weidmuellermodel:ie-wlt-bl-ap-cl-us (buildscope:lteversion:<=v1.16.1818081617)

Trust: 0.6

vendor:weidmuellermodel:ie-wl-bl-ap-cl-eu (buildscope:lteversion:<=v1.16.1818081617)

Trust: 0.6

vendor:weidmuellermodel:ie-wlt-bl-ap-cl-eu (buildscope:lteversion:<=v1.16.1818081617)

Trust: 0.6

vendor:weidmuellermodel:ie-wl-vl-ap-br-cl-eu (buildscope:lteversion:<=v1.11.1018122616)

Trust: 0.6

vendor:weidmuellermodel:ie-wlt-vl-ap-br-cl-eu (buildscope:lteversion:<=v1.11.1018122616)

Trust: 0.6

vendor:weidmuellermodel:ie-wl-vl-ap-br-cl-us (buildscope:lteversion:<=v1.11.1018122616)

Trust: 0.6

vendor:weidmuellermodel:ie-wlt-vl-ap-br-cl-us (buildscope:lteversion:<=v1.11.1018122616)

Trust: 0.6

sources: CNVD: CNVD-2021-48135 // JVNDB: JVNDB-2021-008526 // NVD: CVE-2021-33531

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-33531
value: HIGH

Trust: 1.0

info@cert.vde.com: CVE-2021-33531
value: HIGH

Trust: 1.0

NVD: CVE-2021-33531
value: HIGH

Trust: 0.8

CNVD: CNVD-2021-48135
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202106-1748
value: HIGH

Trust: 0.6

VULMON: CVE-2021-33531
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-33531
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2021-48135
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-33531
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

OTHER: JVNDB-2021-008526
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-48135 // VULMON: CVE-2021-33531 // JVNDB: JVNDB-2021-008526 // CNNVD: CNNVD-202106-1748 // NVD: CVE-2021-33531 // NVD: CVE-2021-33531

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.0

problemtype:Using hardcoded credentials (CWE-798) [ Other ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-008526 // NVD: CVE-2021-33531

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202106-1748

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-202106-1748

PATCH

title:Top Pageurl:https://www.weidmueller.com/int/index.jsp

Trust: 0.8

title:Patch for Weidmueller Industrial WLAN devices trust management issue vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/277141

Trust: 0.6

title:CVE-2021-33531url:https://github.com/AlAIAL90/CVE-2021-33531

Trust: 0.1

sources: CNVD: CNVD-2021-48135 // VULMON: CVE-2021-33531 // JVNDB: JVNDB-2021-008526

EXTERNAL IDS

db:NVDid:CVE-2021-33531

Trust: 3.9

db:CERT@VDEid:VDE-2021-026

Trust: 3.1

db:JVNDBid:JVNDB-2021-008526

Trust: 0.8

db:CNVDid:CNVD-2021-48135

Trust: 0.6

db:CNNVDid:CNNVD-202106-1748

Trust: 0.6

db:VULMONid:CVE-2021-33531

Trust: 0.1

sources: CNVD: CNVD-2021-48135 // VULMON: CVE-2021-33531 // JVNDB: JVNDB-2021-008526 // CNNVD: CNNVD-202106-1748 // NVD: CVE-2021-33531

REFERENCES

url:https://cert.vde.com/en-us/advisories/vde-2021-026

Trust: 3.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-33531

Trust: 0.8

url:https://cwe.mitre.org/data/definitions/798.html

Trust: 0.1

url:https://github.com/alaial90/cve-2021-33531

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2021-48135 // VULMON: CVE-2021-33531 // JVNDB: JVNDB-2021-008526 // CNNVD: CNNVD-202106-1748 // NVD: CVE-2021-33531

SOURCES

db:CNVDid:CNVD-2021-48135
db:VULMONid:CVE-2021-33531
db:JVNDBid:JVNDB-2021-008526
db:CNNVDid:CNNVD-202106-1748
db:NVDid:CVE-2021-33531

LAST UPDATE DATE

2024-08-14T13:23:31.308000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-48135date:2021-07-07T00:00:00
db:VULMONid:CVE-2021-33531date:2021-06-30T00:00:00
db:JVNDBid:JVNDB-2021-008526date:2022-03-18T06:30:00
db:CNNVDid:CNNVD-202106-1748date:2021-07-01T00:00:00
db:NVDid:CVE-2021-33531date:2021-07-27T20:54:08.347

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-48135date:2021-07-07T00:00:00
db:VULMONid:CVE-2021-33531date:2021-06-25T00:00:00
db:JVNDBid:JVNDB-2021-008526date:2022-03-18T00:00:00
db:CNNVDid:CNNVD-202106-1748date:2021-06-25T00:00:00
db:NVDid:CVE-2021-33531date:2021-06-25T19:15:09.080