title: WEIDMUELLER: WLAN devices affected by exploitable format string vulnerability
description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iw_console conio_writestr functionality. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
problem types: CWE-134 Use of Externally-Controlled Format String
affected:
{
product: IE-WL(T)-BL-AP-CL-XX
vendor: Weidmüller
versions:
lessThanOrEqual: V1.16.18 (Build 18081617), status: affected, version: IE-WL-BL-AP-CL-EU (2536600000), versionType: custom
lessThanOrEqual: V1.16.18 (Build 18081617), status: affected, version: IE-WLT-BL-AP-CL-EU (2536650000), versionType: custom
lessThanOrEqual: V1.16.18 (Build 18081617), status: affected, version: IE-WL-BL-AP-CL-US (2536660000), versionType: custom
lessThanOrEqual: V1.16.18 (Build 18081617), status: affected, version: IE-WLT-BL-AP-CL-US (2536670000), versionType: custom
}
{
product: IE-WL(T)-VL-AP-CL-XX
vendor: Weidmüller
versions:
lessThanOrEqual: V1.11.10 (Build 18122616), status: affected, version: IE-WL-VL-AP-BR-CL-EU (2536680000), versionType: custom
lessThanOrEqual: V1.11.10 (Build 18122616), status: affected, version: IE-WLT-VL-AP-BR-CL-EU (2536690000), versionType: custom
lessThanOrEqual: V1.11.10 (Build 18122616), status: affected, version: IE-WL-VL-AP-BR-CL-US (2536700000), versionType: custom
lessThanOrEqual: V1.11.10 (Build 18122616), status: affected, version: IE-WLT-VL-AP-BR-CL-US (2536710000), versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: For IE-WL(T)-BL-AP-CL-XX versions V1.16.21 (Build 21010513) and greater are fixed.
For IE-WL(T)-VL-AP-CL-XX versions V1.11.13 (Build 21010513) and greater are fixed.