In Weidmueller Industrial WLAN devices in multiple versions an exploitable authentication bypass vulnerability exists in the hostname processing. A specially configured device hostname can cause the device to interpret selected remote traffic as local traffic, resulting in a bypass of web authentication. An attacker can send authenticated SNMP requests to trigger this vulnerability.
Solution:
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Link | Tags |
|---|---|
| https://cert.vde.com/en-us/advisories/vde-2021-026 | third party advisory |