CVE-2021-33528

CVE-2021-33528 affects Weidmueller Industrial WLAN devices. A vulnerability in the iw_console allows a specially crafted menu selection string to escape the restricted console, granting root access. Attacks can occur with low-privilege user authentication and no user interaction required. The rep...

PT-2021-20175

Name of the Vulnerable Software and Affected Versions Weidmueller Industrial WLAN devices affected versions not specified Description A privilege escalation issue exists in the iw console functionality, allowing an attacker to escape the restricted console and gain system access as the root user...

PT-2021-20182

Name of the Vulnerable Software and Affected Versions Weidmueller Industrial WLAN devices affected versions not specified Description A format string vulnerability exists in the iw console conio writestr functionality, allowing for remote code execution. This can be triggered by a specially craft...

CVE-2021-33534: Improper Neutralization of Special Elements used in an OS Command

In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device...

CVE-2021-33535: Use of Externally-Controlled Format String

In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iwconsole coniowritestr functionality. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can se...

CVE-2021-33537: Buffer Copy without Checking Size of Input

In Weidmueller Industrial WLAN devices in multiple versions an exploitable remote code execution vulnerability exists in the iwwebs configuration parsing functionality. A specially crafted user name entry can cause an overflow of an error message buffer, resulting in remote code execution. An...

CVE-2021-33530: Improper Neutralization of Special Elements used in an OS Command

In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the devices. A specially crafted diagnostic script file can cause arbitrary busybox commands to be executed, resulting in remote contro...

PT-2021-20177

Name of the Vulnerable Software and Affected Versions Weidmueller Industrial WLAN devices affected versions not specified Description A command injection issue exists in the encrypted diagnostic script functionality of the devices. This allows a specially crafted diagnostic script file to execute...

PT-2021-20176

Name of the Vulnerable Software and Affected Versions Weidmueller Industrial WLAN devices affected versions not specified Description The issue concerns the usage of hard-coded cryptographic keys within the service agent binary in Weidmueller Industrial WLAN devices. This allows for the decryptio...

PT-2021-20183

Name of the Vulnerable Software and Affected Versions Weidmueller Industrial WLAN devices affected versions not specified Description A denial-of-service issue exists in the ServiceAgent functionality due to an integer underflow caused by a specially crafted packet. This underflow triggers a larg...

CVE-2021-33536: Integer Underflow (Wrap or Wraparound)

In Weidmueller Industrial WLAN devices in multiple versions an exploitable denial-of-service vulnerability exists in ServiceAgent functionality. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will access unmapped or out-of-bounds memory. An attacker can...

CVE-2021-33538: Improper Privilege Management

In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iwwebs account settings functionality. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access ...

CVE-2021-33531: Use of Hard-coded Credentials

In Weidmueller Industrial WLAN devices in multiple versions an exploitable use of hard-coded credentials vulnerability exists in multiple iw utilities. The device operating system contains an undocumented encryption password, allowing for the creation of custom diagnostic scripts. An attacker can...

PT-2021-20181

Name of the Vulnerable Software and Affected Versions Weidmueller Industrial WLAN devices affected versions not specified Description A command injection issue exists in the hostname functionality of the affected devices. This allows an attacker to execute arbitrary system commands by making a...

PT-2021-20180

Name of the Vulnerable Software and Affected Versions Weidmueller Industrial WLAN devices affected versions not specified Description A command injection issue exists in the iw webs functionality, allowing an attacker to gain remote control over the device. This can be triggered by a specially...

PT-2021-20179

Name of the Vulnerable Software and Affected Versions Weidmueller Industrial WLAN devices affected versions not specified Description A command injection issue exists in the iw webs functionality, allowing an attacker to gain remote control over the device. This can be triggered by a specially...

CVE-2021-33529: Use of Hard-coded Credentials

In Weidmueller Industrial WLAN devices in multiple versions the usage of hard-coded cryptographic keys within the service agent binary allows for the decryption of captured traffic across the network from or to the device...

CVE-2021-33528: Improper Adherence to Coding Standards

In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iwconsole functionality. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker...

CVE-2021-33533: Improper Neutralization of Special Elements used in an OS Command

In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iwwebs functionality. A specially crafted iwserverip parameter can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. ...

PT-2021-20184

Name of the Vulnerable Software and Affected Versions Weidmueller Industrial WLAN devices affected versions not specified Description A remote code execution issue exists in the configuration parsing functionality of the iw webs due to an error message buffer overflow. This can be triggered by a...