title: WEIDMUELLER: Accidentally open network port in u-controls and IoT-Gateways
description: In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally accessible via external network interfaces. By exploiting this vulnerability the device may be manipulated or the operation may be stopped.
problem types: CWE-668 Exposure of Resource to Wrong Sphere
affected:
{
product: UC20-WL2000-AC (No. 1334950000)
vendor: Weidmüller
versions:
lessThanOrEqual: 1.9.0, status: affected, version: 1.3.0, versionType: custom
lessThanOrEqual: 1.10.2, status: affected, version: 1.10.0, versionType: custom
lessThanOrEqual: 1.12.1, status: affected, version: 1.11.0, versionType: custom
}
{
product: UC20-WL2000-IOT (No. 1334990000)
vendor: Weidmüller
versions:
lessThanOrEqual: 1.9.0, status: affected, version: 1.3.0, versionType: custom
lessThanOrEqual: 1.10.2, status: affected, version: 1.10.0, versionType: custom
lessThanOrEqual: 1.12.1, status: affected, version: 1.11.0, versionType: custom
}
{
product: IOT-GW30 (No. 2682620000)
vendor: Weidmüller
versions:
lessThanOrEqual: 1.9.0, status: affected, version: 1.3.0, versionType: custom
lessThanOrEqual: 1.10.2, status: affected, version: 1.10.0, versionType: custom
lessThanOrEqual: 1.12.1, status: affected, version: 1.11.0, versionType: custom
}
{
product: IOT-GW30-4G-EU (No. 2682630000)
vendor: Weidmüller
versions:
lessThanOrEqual: 1.9.0, status: affected, version: 1.3.0, versionType: custom
lessThanOrEqual: 1.10.2, status: affected, version: 1.10.0, versionType: custom
lessThanOrEqual: 1.12.1, status: affected, version: 1.11.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
]
solutions: Weidmüller recommends upgrading affected devices to the current firmware version 1.12.3 or higher which fixes this vulnerability.
workarounds: Restrict access to the network the device is connected to.
Do not directly connect the device to the internet.