CVE-2021-33552

UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1 · 7.2 High EPSS 51.0% KEV · Not listed

Vendors

Geutebrueck

Products

G-cam Ebc-2110 G-cam Ebc-2110 Firmware G-cam Ebc-2111 and 29 more

CVE-2021-33551

UDP Technology/Geutebrück camera devices: Command injection in environment.lang parameter leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1 · 7.2 High EPSS 51.0% KEV · Not listed

Vendors

Geutebrueck

Products

G-cam Ebc-2110 G-cam Ebc-2110 Firmware G-cam Ebc-2111 and 29 more

CVE-2021-33550

UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1 · 7.2 High EPSS 59.2% KEV · Not listed

Vendors

Geutebrueck

Products

G-cam Ebc-2110 G-cam Ebc-2110 Firmware G-cam Ebc-2111 and 29 more

CVE-2021-33549

UDP Technology/Geutebrück camera devices: Buffer overflow in action parameter leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1 · 7.2 High EPSS 67.3% KEV · Not listed

Vendors

Geutebrueck

Products

G-cam Ebc-2110 G-cam Ebc-2110 Firmware G-cam Ebc-2111 and 29 more

CVE-2021-33548

UDP Technology/Geutebrück camera devices: Command injection in preserve parameter leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1 · 7.2 High EPSS 59.2% KEV · Not listed

Vendors

Geutebrueck

Products

G-cam Ebc-2110 G-cam Ebc-2110 Firmware G-cam Ebc-2111 and 29 more

CVE-2021-33547

UDP Technology/Geutebrück camera devices: Buffer overflow in profile parameter leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the profile parameter which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1 · 7.2 High EPSS 2.8% KEV · Not listed

Vendors

Geutebrueck

Products

G-cam Ebc-2110 G-cam Ebc-2110 Firmware G-cam Ebc-2111 and 29 more

CVE-2021-33546

UDP Technology/Geutebrück camera devices: Buffer overflow in name parameter leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the name parameter, which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1 · 7.2 High EPSS 2.8% KEV · Not listed

Vendors

Geutebrueck

Products

G-cam Ebc-2110 G-cam Ebc-2110 Firmware G-cam Ebc-2111 and 29 more

CVE-2021-33545

UDP Technology/Geutebrück camera devices: Buffer overflow in counter parameter leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the counter parameter which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1 · 7.2 High EPSS 2.8% KEV · Not listed

Vendors

Geutebrueck

Products

G-cam Ebc-2110 G-cam Ebc-2110 Firmware G-cam Ebc-2111 and 29 more

CVE-2021-33544

UDP Technology/Geutebrück camera devices: command injection leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1 · 7.2 High EPSS 95.8% KEV · Not listed

Vendors

Geutebrueck

Products

G-cam Ebc-2110 G-cam Ebc-2110 Firmware G-cam Ebc-2111 and 29 more

CVE-2021-33543

UDP Technology/Geutebrück camera devices: Authentication Bypass

Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. This can lead to manipulation of the device and denial of service.

CVSS 3.1 · 9.8 Critical EPSS 81.3% KEV · Not listed

Vendors

Geutebrueck

Products

G-cam Ebc-2110 G-cam Ebc-2110 Firmware G-cam Ebc-2111 and 29 more

CVE-2021-33542

Phoenix Contact: Automation Worx Software Suite affected by Remote Code Execution (RCE) vulnerability

Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The attacker needs to get access to an original bus configuration file (*.bcp) to be able to manipulate data inside. After manipulation the attacker needs to exchange the original file by the manipulated one on the application programming workstation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.

CVSS 3.1 · 7.8 High EPSS 1.8% KEV · Not listed

Vendors

Phoenixcontact

Products

Config\+ Pc Worx Pc Worx Express

CVE-2021-33541

Phoenix Contact: ILC1x Industrial controllers affected by Denial-of-Service vulnerability

Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a denial of service on the PLC's network communication module. A successful attack stops all network communication. To restore the network connectivity the device needs to be restarted. The automation task is not affected.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Phoenixcontact

Products

Ilc1x0 Ilc1x0 Firmware Ilc1x1 and 1 more

CVE-2021-33540

Phoenix Contact: Undocumented FTP acces in certain AXL F BK and IL BK devices

In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Phoenixcontact

Products

Axl F Bk Eip Axl F Bk Eip Ef Axl F Bk Eip Ef Firmware and 33 more

CVE-2021-33539

WEIDMUELLER: WLAN devices affected by authentication bypass vulnerability

In Weidmueller Industrial WLAN devices in multiple versions an exploitable authentication bypass vulnerability exists in the hostname processing. A specially configured device hostname can cause the device to interpret selected remote traffic as local traffic, resulting in a bypass of web authentication. An attacker can send authenticated SNMP requests to trigger this vulnerability.

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed

Vendors

Weidmueller

Products

Ie-wl-bl-ap-cl-eu Ie-wl-bl-ap-cl-eu Firmware Ie-wl-bl-ap-cl-us and 13 more

CVE-2021-33538

WEIDMUELLER: WLAN devices affected by improper access control vulnerability

In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iw_webs account settings functionality. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as that user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Weidmueller

Products

Ie-wl-bl-ap-cl-eu Ie-wl-bl-ap-cl-eu Firmware Ie-wl-bl-ap-cl-us and 13 more

CVE-2021-33537

WEIDMUELLER: WLAN devices affected by Remote Code Execution (RCE) vulnerability

In Weidmueller Industrial WLAN devices in multiple versions an exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality. A specially crafted user name entry can cause an overflow of an error message buffer, resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Weidmueller

Products

Ie-wl-bl-ap-cl-eu Ie-wl-bl-ap-cl-eu Firmware Ie-wl-bl-ap-cl-us and 13 more

CVE-2021-33536

WEIDMUELLER: WLAN devices affected by Denial-of-Service vulnerability

In Weidmueller Industrial WLAN devices in multiple versions an exploitable denial-of-service vulnerability exists in ServiceAgent functionality. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will access unmapped or out-of-bounds memory. An attacker can send this packet while unauthenticated to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Weidmueller

Products

Ie-wl-bl-ap-cl-eu Ie-wl-bl-ap-cl-eu Firmware Ie-wl-bl-ap-cl-us and 13 more

CVE-2021-33535

WEIDMUELLER: WLAN devices affected by exploitable format string vulnerability

In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iw_console conio_writestr functionality. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Weidmueller

Products

Ie-wl-bl-ap-cl-eu Ie-wl-bl-ap-cl-eu Firmware Ie-wl-bl-ap-cl-us and 13 more

CVE-2021-33534

WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability

In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send various requests while authenticated as a high privilege user to trigger this vulnerability.

CVSS 3.1 · 7.2 High EPSS 2.1% KEV · Not listed

Vendors

Weidmueller

Products

Ie-wl-bl-ap-cl-eu Ie-wl-bl-ap-cl-eu Firmware Ie-wl-bl-ap-cl-us and 13 more

CVE-2021-33533

WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability

In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted iw_serverip parameter can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Weidmueller

Products

Ie-wl-bl-ap-cl-eu Ie-wl-bl-ap-cl-eu Firmware Ie-wl-bl-ap-cl-us and 13 more