CVE-2021-33528
WEIDMUELLER: WLAN devices affected by privilege escalation vulnerability
In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iw_console functionality. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
WEIDMUELLER: WLAN devices affected by privilege escalation vulnerability
In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iw_console functionality. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
- Record
CVE-2021-33528- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-710
- Updated
- 2026-11-02
EUVDEUVD-2021-20220
In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iw_console functionality. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
- Record
EUVD-2021-20220- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q573-wgw4-2h26 No score
In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation...
In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iw_console functionality. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
- Record
GHSA-q573-wgw4-2h26- Weakness
- CWE-710
- Updated
- 2026-11-02
NVD
In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iw_console functionality. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
- Record
CVE-2021-33528- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-710
- Updated
- 2026-11-02
Affected products
- weidmueller ie-wl-bl-ap-cl-eu firmware
- weidmueller ie-wl-bl-ap-cl-us firmware
- weidmueller ie-wl-vl-ap-br-cl-eu firmware
- weidmueller ie-wl-vl-ap-br-cl-us firmware
- weidmueller ie-wlt-bl-ap-cl-eu firmware
- weidmueller ie-wlt-bl-ap-cl-us firmware
- weidmueller ie-wlt-vl-ap-br-cl-eu firmware
- weidmueller ie-wlt-vl-ap-br-cl-us firmware
- weidmüller ie-wl(t)-bl-ap-cl-xx
- weidmüller ie-wl(t)-vl-ap-cl-xx
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-33528 is a high vulnerability (CVSS 8.8) in Weidmueller Ie-wl-bl-ap-cl-eu Firmware, published June 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. No source names a fixed version.