CVE-2021-33539 WEIDMUELLER: WLAN devices affected by authentication bypass vulnerability

High 7.2 Published 25 Jun 2021 Updated 16 Sep 2024

Attackers can bypass web authentication on Weidmüller Industrial WLAN devices by manipulating hostname processing to treat remote traffic as local.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-33539?

CVE-2021-33539 is a high-severity authentication bypass vulnerability in Weidmüller IE-WL(T)-BL-AP-CL-XX, published on 25 Jun 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

In Weidmueller Industrial WLAN devices in multiple versions an exploitable authentication bypass vulnerability exists in the hostname processing. A specially configured device hostname can cause the device to interpret selected remote traffic as local traffic, resulting in a bypass of web authentication. An attacker can send authenticated SNMP requests to trigger this vulnerability.

Weakness: CWE-287

Which versions are affected by CVE-2021-33539?

It affects 8 products.

Products include Weidmueller Ie-Wl-Bl-Ap-Cl-Eu Firmware, Weidmueller Ie-Wl-Bl-Ap-Cl-Us Firmware, Weidmueller Ie-Wl-Vl-Ap-Br-Cl-Eu Firmware, Weidmueller Ie-Wl-Vl-Ap-Br-Cl-Us Firmware, Weidmueller Ie-Wlt-Bl-Ap-Cl-Eu Firmware, Weidmueller Ie-Wlt-Bl-Ap-Cl-Us Firmware and 2 more.

How do I fix CVE-2021-33539?

No fix has been published for CVE-2021-33539 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-33539 being exploited?

There is no known exploitation of CVE-2021-33539 in the wild and no public exploit code.

Sources

Also known as GHSA-9vqf-5jhj-hm4w.