by Kastro
Paper/Archive/CVE-2021-20999

CVE-2021-20999

Weidmüller UC20-WL2000-AC (No. 1334950000) — WEIDMUELLER: Accidentally open network port in u-controls and IoT-Gateways

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.2.612 × 2012.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally accessible via external network interfaces. By exploiting this vulnerability the device may be manipulated or the operation may be stopped.

Affected

ProductAffectedFixed inSource
UC20-WL2000-AC (No. 1334950000)1.3.0 – 1.9.0–CNA
UC20-WL2000-AC (No. 1334950000)1.10.0 – 1.10.2–CNA
UC20-WL2000-AC (No. 1334950000)1.11.0 – 1.12.1–CNA
UC20-WL2000-IOT (No. 1334990000)1.3.0 – 1.9.0–CNA
UC20-WL2000-IOT (No. 1334990000)1.10.0 – 1.10.2–CNA
UC20-WL2000-IOT (No. 1334990000)1.11.0 – 1.12.1–CNA
IOT-GW30 (No. 2682620000)1.3.0 – 1.9.0–CNA
IOT-GW30 (No. 2682620000)1.10.0 – 1.10.2–CNA
IOT-GW30 (No. 2682620000)1.11.0 – 1.12.1–CNA
IOT-GW30-4G-EU (No. 2682630000)1.3.0 – 1.9.0–CNA
IOT-GW30-4G-EU (No. 2682630000)1.10.0 – 1.10.2–CNA
IOT-GW30-4G-EU (No. 2682630000)1.11.0 – 1.12.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CERTVDE (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

References

refcert.vde.com/en-us/advisories/vde-2021-016