vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-20999

WEIDMUELLER: Accidentally open network port in u-controls and IoT-Gateways

CRITICAL
9.8
CVSS Score
Published: May 13, 2021 at 01:45 PM UTC
Updated: June 17, 2026 at 03:34 AM UTC
12 products affected across 2 vendorsUc20-wl2000-ac FirmwareIot GW30 FirmwareUc20-wl2000-iot Firmware

Using UC20-WL2000-AC (No. 1334950000) by Weidmüller?

Get instant alerts when new vulnerabilities affect UC20-WL2000-AC (No. 1334950000) - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
CRITICAL9.8
Exploit prediction
EPSS 0.9%

Description

In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally accessible via external network interfaces. By exploiting this vulnerability the device may be manipulated or the operation may be stopped.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Iot Gw30-4g Eu Firmware· Weidmueller
95%
1.10.0 ≤ v < 1.10.31.3.0 ≤ v < 1.9.11.11.01.12.1
Affected range stops below 1.10.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.9.1, so it looks safe — our inference, not a vendor statement
weidmueller-iot-gw30-4g-eu (same device)
Iot GW30 Firmware· Weidmueller
95%
1.10.0 ≤ v < 1.10.31.3.0 ≤ v < 1.9.11.11.01.12.1
Affected range stops below 1.10.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.9.1, so it looks safe — our inference, not a vendor statement
weidmueller-iot-gw30 (same device)
Uc20-wl2000-ac Firmware· Weidmueller
95%
1.10.0 ≤ v < 1.10.31.3.0 ≤ v < 1.9.11.11.01.12.1
Affected range stops below 1.10.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.9.1, so it looks safe — our inference, not a vendor statement
weidmueller-uc20-wl2000-ac (same device)
Uc20-wl2000-iot Firmware· Weidmueller
95%
1.10.0 ≤ v < 1.10.31.3.0 ≤ v < 1.9.11.11.01.12.1
Affected range stops below 1.10.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.9.1, so it looks safe — our inference, not a vendor statement
weidmueller-uc20-wl2000-iot (same device)
IOT-GW30· Weidm Ller
60%
1.10.0 ≤ v ≤ 1.10.21.11.0 ≤ v ≤ 1.12.11.3.0 ≤ v ≤ 1.9.01.10.01.11.01.3.0
IOT-GW30-4G-EU· Weidm Ller
60%
1.10.0 ≤ v ≤ 1.10.21.11.0 ≤ v ≤ 1.12.11.3.0 ≤ v ≤ 1.9.01.10.01.11.01.3.0
UC20-WL2000-AC· Weidm Ller
60%
1.10.0 ≤ v ≤ 1.10.21.11.0 ≤ v ≤ 1.12.11.3.0 ≤ v ≤ 1.9.01.10.01.11.01.3.0
UC20-WL2000-IOT· Weidm Ller
60%
1.10.0 ≤ v ≤ 1.10.21.11.0 ≤ v ≤ 1.12.11.3.0 ≤ v ≤ 1.9.01.10.01.11.01.3.0
Iot-Gw30· Weidmuellerdevice
80%
All versions
Iot-Gw30-4G-Eu· Weidmuellerdevice
80%
All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://cert.vde.com/en-us/advisories/vde-2021-016

CVSS

9.8CRITICAL[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-668NVD-CWE-Other

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card