CVE-2021-20999: WEIDMUELLER: Accidentally open network port in u-controls and IoT-Gateways

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-13 · updated 2026-06-17
Weakness: CWE-668

Description

In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally accessible via external network interfaces. By exploiting this vulnerability the device may be manipulated or the operation may be stopped.

Affected products

Weidmueller Iot-Gw30-4G-Eu Firmware: from 1.3.0 before 1.9.1; from 1.10.0 before 1.10.3; 1.11.0, 1.12.1 — fixed in 1.10.3, 1.9.1
Weidmueller Iot-Gw30 Firmware: from 1.3.0 before 1.9.1; from 1.10.0 before 1.10.3; 1.11.0, 1.12.1 — fixed in 1.10.3, 1.9.1
Weidmueller Uc20-Wl2000-Ac Firmware: from 1.3.0 before 1.9.1; from 1.10.0 before 1.10.3; 1.11.0, 1.12.1 — fixed in 1.10.3, 1.9.1
Weidmueller Uc20-Wl2000-Iot Firmware: from 1.3.0 before 1.9.1; from 1.10.0 before 1.10.3; 1.11.0, 1.12.1 — fixed in 1.10.3, 1.9.1

How to fix

Upgrade to a fixed version: Weidmueller Iot-Gw30-4G-Eu Firmware 1.10.3, 1.9.1; Weidmueller Iot-Gw30 Firmware 1.10.3, 1.9.1; Weidmueller Uc20-Wl2000-Ac Firmware 1.10.3, 1.9.1; Weidmueller Uc20-Wl2000-Iot Firmware 1.10.3, 1.9.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-20999 or the next vulnerability affects your stack