CVE-2021-33529 WEIDMUELLER: WLAN devices affected by Hard-coded Credentials vulnerability
Hard-coded cryptographic keys in Weidmüller Industrial WLAN devices allow attackers to decrypt captured network traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-33529?
CVE-2021-33529 is a high-severity vulnerability in Weidmüller IE-WL(T)-BL-AP-CL-XX, published on 25 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Weidmueller Industrial WLAN devices in multiple versions the usage of hard-coded cryptographic keys within the service agent binary allows for the decryption of captured traffic across the network from or to the device.
Weakness: CWE-798
Which versions are affected by CVE-2021-33529?
It affects 8 products.
Products include Weidmueller Ie-Wl-Bl-Ap-Cl-Eu Firmware, Weidmueller Ie-Wl-Bl-Ap-Cl-Us Firmware, Weidmueller Ie-Wl-Vl-Ap-Br-Cl-Eu Firmware, Weidmueller Ie-Wl-Vl-Ap-Br-Cl-Us Firmware, Weidmueller Ie-Wlt-Bl-Ap-Cl-Eu Firmware, Weidmueller Ie-Wlt-Bl-Ap-Cl-Us Firmware and 2 more.
How do I fix CVE-2021-33529?
No fix has been published for CVE-2021-33529 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-33529 being exploited?
There is no known exploitation of CVE-2021-33529 in the wild and no public exploit code.
Other vulnerabilities in Weidmüller IE-WL(T)-BL-AP-CL-XX
- CVE-2021-33528 WEIDMUELLER: WLAN devices affected by privilege escalation vulnerability
- CVE-2021-33530 WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability
- CVE-2021-33531 WEIDMUELLER: WLAN devices affected by Hard-coded Credentials vulnerability
- CVE-2021-33532 WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability
- CVE-2021-33533 WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability
Sources
Also known as GHSA-6jrh-f26m-pv7v.