Weidmüller IE-WL-BL-AP-CL-EU — kwetsbaarheid CVE-2021-33532

In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

For all potential vulnerabilities, customers can download a patched firmware to secure their Industrial WLAN devices properly. Please follow the procedure below to download and install the latest firmware for your device: 1. Use the link: [www.weidmueller.com](www.weidmueller.com) 2. Enter the product number of the Industrial WLAN device you want to update in the search field on the webpage and press "Enter". 3. On the next page, expand the drop-down menu **"Downloads"**. 4. Download the respective firmware from the download table. 5. Install the firmware on your device. Patched firmware versions for all affected products | Product number | Product name | Firmware version | |---------------|-----------------------------------|------------------------------------------| | 2536600000 | IE-WL-BL-AP-CL-EU | <= V1.16.21 (Build 21010513) | | 2536650000 | IE-WLT-BL-AP-CL-EU | <= V1.16.21 (Build 21010513) | | 2536660000 | IE-WL-BL-AP-CL-US | <= V1.16.21 (Build 21010513) | | 2536670000 | IE-WLT-BL-AP-CL-US | <= V1.16.21 (Build 21010513) | | 2536680000 | IE-WL-VL-AP-BR-CL-EU | <= V1.11.13 (Build 21010513) | | 2536690000 | IE-WLT-VL-AP-BR-CL-EU | <= V1.11.13 (Build 21010513) | | 2536700000 | IE-WL-VL-AP-BR-CL-US | <= V1.11.13 (Build 21010513) | | 2536710000 | IE-WLT-VL-AP-BR-CL-US | <= V1.11.13 (Build 21010513) | If a firmware update is available for your device, please follow the steps above to install it.