CVE-2021-33533 : Security Advisory and Response

A command injection vulnerability has been identified in Weidmüller Industrial WLAN devices, potentially allowing remote attackers to execute commands and take control of the affected devices. Here is a detailed overview of CVE-2021-33533.

Understanding CVE-2021-33533

This section provides insights into the nature and impact of the vulnerability.

What is CVE-2021-33533?

In Weidmüller Industrial WLAN devices, a command injection vulnerability exists due to a flaw in the iw_webs functionality. By manipulating the iw_serverip parameter, an attacker can inject commands that are then executed by the device, leading to unauthorized remote control.

The Impact of CVE-2021-33533

The vulnerability poses a high risk with a CVSS base score of 8.8 (High severity). Attackers can exploit this flaw to compromise the confidentiality, integrity, and availability of the affected systems.

Technical Details of CVE-2021-33533

In this section, we delve into the technical aspects of the vulnerability.

Vulnerability Description

The vulnerability allows an authenticated low-privilege user to execute arbitrary commands on the device by manipulating a specific parameter.

Affected Systems and Versions

Weidmüller Industrial WLAN devices with the following versions are affected:

IE-WL(T)-BL-AP-CL-XX: V1.16.18 (Build 18081617) and below
IE-WL(T)-VL-AP-CL-XX: V1.11.10 (Build 18122616) and below

Exploitation Mechanism

Attackers can exploit this vulnerability remotely over the network without requiring user interaction, making it a critical security concern.

Mitigation and Prevention

This section outlines the steps to mitigate the risks associated with CVE-2021-33533.

Immediate Steps to Take

Update IE-WL(T)-BL-AP-CL-XX to version V1.16.21 (Build 21010513) or higher
Update IE-WL(T)-VL-AP-CL-XX to version V1.11.13 (Build 21010513) or higher

Long-Term Security Practices

Regularly monitor for security advisories and updates from Weidmüller
Implement network segmentation and access controls to limit attack surfaces

Patching and Updates

Apply patches and firmware updates provided by Weidmüller to address the vulnerability.