Weidmueller Industrial Ethernet Switches

Risk Summary

Successful exploitation of these vulnerabilities could allow a remote attacker to gain unauthorized access to the device, affecting the confidentiality, integrity, and availability of the device the attacker is targeting.

CVEs (5)

Remediations

• Solution for vulnerabilities, valid for switch series IE-SW-VL05M and IE-SW-VL08MT
• To avoid the vulnerabilities referred to in this section, it is necessary to install patched firmware. After installation of patched firmware, the web interface can be accessed via encrypted communication using https, and web interface access can be configured to ensure encrypted connections by selecting “https only.”
• The respective web interface menu section for this setting can be reached via the following path: Main Menu > Basic Settings > System: Set the “Web Configuration” to “https only.”
• Solution for vulnerabilities valid for switch series IE-SW-PL08M, IE-SW-PL10M, IE-SW-PL16M, IE-SW-PL18M, and IE-SW-PL09M
• To avoid the vulnerabilities referred to in this section, installation of patched firmware is not necessary. Web interface access can be configured to ensure encrypted connections by selecting “https only.”
• Solution for CVE-2019-16670, CVE-2019-16671, CVE-2019-16673, and CVE-2019-16674
• Valid for switch series IE-SW-VL05M, IE-SW-VL08MT, IE-SW-PL08M, IE-SW-PL10M, IE-SW-PL16M, IE-SW-PL18M, and IE-SW-PL09M
• After installing the patched firmware on the switch, it is possible to disable the unencrypted search service via Weidmueller configuration software named “WM Switch Utility” for Windows OS and to enable an encrypted search service, which will be working with the new “Weidmueller Switch Configuration Utility” (available soon).
• Both services—the encrypted and the unencrypted search service—are enabled by default. To avoid the vulnerabilities referred to in this section, the unencrypted search service should be disabled.
• The respective web interface menu section for this setting can be reached via the following path: Main Menu > Basic Settings > Security > Management Interface: Uncheck the checkbox “Enable Search Service.”
• Note: After disabling the unencrypted search service, the switches can no longer be found or configured with the current “WM Switch Utility.”
• Web interface settings are not affected by this configuration.
• IE-SW-VL05M-5TX firmware v3.6.24 Build 19062809 and prior
• IE-SW-VL05MT-5TX firmware v3.6.24 Build 19062809 and prior
• IE-SW-VL05M-3TX-2SC firmware v3.6.24 Build 19062809 and prior
• IE-SW-VL05MT-3TX-2SC firmware v3.6.24 Build 19062809 and prior
• IE-SW-VL05M-3TX-2ST firmware v3.6.24 Build 19062809 and prior
• IE-SW-VL05MT-3TX-2ST firmware v3.6.24 Build 19062809 and prior
• IE-SW-VL08MT-8TX firmware v3.5.22 Build 19062810 and prior
• IE-SW-VL08MT-5TX-3SC firmware v3.5.22 Build 19062810 and prior
• IE-SW-VL08MT-5TX-1SC-2SCS firmware v3.5.22 Build 19062810 and prior
• IE-SW-VL08MT-6TX-2ST firmware v3.5.22 Build 19062810 and prior
• IE-SW-VL08MT-6TX-2SC firmware v3.5.22 Build 19062810 and prior
• IE-SW-VL08MT-6TX-2SCS firmware v3.5.22 Build 19062810 and prior
• IE-SW-PL08M-8TX firmware v3.3.16 Build 19062811 and prior
• IE-SW-PL08MT-8TX firmware v3.3.16 Build 19062811 and prior
• IE-SW-PL08M-6TX-2SC firmware v3.3.16 Build 19062811 and prior
• IE-SW-PL08MT-6TX-2SC firmware v3.3.16 Build 19062811 and prior
• IE-SW-PL08M-6TX-2ST firmware v3.3.16 Build 19062811and prior
• IE-SW-PL08MT-6TX-2ST firmware v3.3.16 Build 19062811 and prior
• IE-SW-PL08M-6TX-2SCS firmware v3.3.16 Build 19062811 and prior
• IE-SW-PL08MT-6TX-2SCS firmware v3.3.16 Build 19062811 and prior
• IE-SW-PL10M-3GT-7TX firmware v3.3.24 Build 19062813 and prior
• IE-SW-PL10MT-3GT-7TX firmware v3.3.24 Build 19062813 and prior
• IE-SW-PL10M-1GT-2GS-7TX firmware v3.3.24 Build 19062813 and prior
• IE-SW-PL10MT-1GT-2GS-7TX firmware v3.3.24 Build 19062813 and prior
• IE-SW-PL16M-16TX firmware v3.4.18 Build 19062814 and prior
• IE-SW-PL16MT-16TX firmware v3.4.18 Build 19062814 and prior
• IE-SW-PL16M-14TX-2SC firmware v3.4.18 Build 19062814 and prior
• IE-SW-PL16MT-14TX-2SC firmware v3.4.18 Build 19062814 and prior
• IE-SW-PL16M-14TX-2ST firmware v3.4.18 Build 19062814 and prior
• IE-SW-PL16MT-14TX-2ST firmware v3.4.18 Build 19062814 and prior
• IE-SW-PL18M-2GC-16TX firmware v3.4.30 Build 19062817 and prior
• IE-SW-PL18MT-2GC-16TX firmware v3.4.30 Build 19062817 and prior
• IE-SW-PL18M-2GC14TX2SC firmware v3.4.30 Build 19062817 and prior
• IE-SW-PL18MT-2GC14TX2SC firmware v3.4.30 Build 19062817 and prior
• IE-SW-PL18M-2GC14TX2ST firmware v3.4.30 Build 19062817 and prior
• IE-SW-PL18MT-2GC14TX2ST firmware v3.4.30 Build 19062817 and prior
• IE-SW-PL18M-2GC14TX2SCS firmware v3.4.30 Build 19062817 and prior
• IE-SW-PL18MT-2GC14TX2SCS firmware v3.4.30 Build 19062817 and prior
• IE-SW-PL09M-5GC-4GT firmware v3.3.20 Build 19070111 and prior
• IE-SW-PL09MT-5GC-4GT firmware v3.3.20 Build 19070111 and prior
• For more information see the CERT@VDE advisory located at: https://cert.vde.com/en-us/advisories/vde-2019-018 or contact Weidmueller at www.weidmueller.com/service.
• Solutions for CVE-2019-16672

Affected Vendors

Affected Products (40)

Affected Sectors

Critical Manufacturing, Information Technology