CVE-2019-16672
📋 TL;DR
This vulnerability allows attackers to intercept sensitive credentials transmitted in cleartext on affected Weidmueller industrial switches. Attackers on the same network can capture authentication data, potentially gaining unauthorized access to network infrastructure. Organizations using Weidmueller IE-SW-VL05M, IE-SW-VL08MT, or IE-SW-PL10M devices with specific firmware versions are affected.
💻 Affected Systems
- Weidmueller IE-SW-VL05M
- Weidmueller IE-SW-VL08MT
- Weidmueller IE-SW-PL10M
📦 What is this software?
Ie Sw Pl08m 6tx 2scs Firmware by Weidmueller
Ie Sw Pl08mt 6tx 2sc Firmware by Weidmueller
Ie Sw Pl08mt 6tx 2scs Firmware by Weidmueller
Ie Sw Pl08mt 6tx 2st Firmware by Weidmueller
Ie Sw Pl09mt 5gc 4gt Firmware by Weidmueller
Ie Sw Pl10m 1gt 2gs 7tx Firmware by Weidmueller
Ie Sw Pl10mt 1gt 2gs 7tx Firmware by Weidmueller
Ie Sw Pl10mt 3gt 7tx Firmware by Weidmueller
Ie Sw Pl16m 14tx 2sc Firmware by Weidmueller
Ie Sw Pl16m 14tx 2st Firmware by Weidmueller
Ie Sw Pl16mt 14tx 2sc Firmware by Weidmueller
Ie Sw Pl16mt 14tx 2st Firmware by Weidmueller
Ie Sw Pl18m 2gc 16tx Firmware by Weidmueller
Ie Sw Pl18m 2gc14tx2sc Firmware by Weidmueller
Ie Sw Pl18m 2gc14tx2scs Firmware by Weidmueller
Ie Sw Pl18m 2gc14tx2st Firmware by Weidmueller
Ie Sw Pl18mt 2gc 16tx Firmware by Weidmueller
Ie Sw Pl18mt 2gc14tx2sc Firmware by Weidmueller
Ie Sw Pl18mt 2gc14tx2scs Firmware by Weidmueller
Ie Sw Pl18mt 2gc14tx2st Firmware by Weidmueller
Ie Sw Vl05mt 3tx 2sc Firmware by Weidmueller
Ie Sw Vl05mt 3tx 2st Firmware by Weidmueller
Ie Sw Vl08mt 5tx 1sc 2scs Firmware by Weidmueller
View all CVEs affecting Ie Sw Vl08mt 5tx 1sc 2scs Firmware →
Ie Sw Vl08mt 5tx 3sc Firmware by Weidmueller
Ie Sw Vl08mt 6tx 2sc Firmware by Weidmueller
Ie Sw Vl08mt 6tx 2scs Firmware by Weidmueller
Ie Sw Vl08mt 6tx 2st Firmware by Weidmueller
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to industrial switches, enabling network disruption, traffic interception, or lateral movement to critical industrial control systems.
Likely Case
Attackers capture credentials and gain unauthorized access to network devices, potentially modifying configurations or monitoring traffic.
If Mitigated
With proper network segmentation and monitoring, impact is limited to credential exposure requiring additional steps for exploitation.
🎯 Exploit Status
Exploitation requires network access but no authentication. Attackers can use standard network sniffing tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Weidmueller for updated firmware
Vendor Advisory: https://cert.vde.com/en-us/advisories/vde-2019-018
Restart Required: Yes
Instructions:
1. Contact Weidmueller support for updated firmware. 2. Backup current configuration. 3. Apply firmware update following vendor instructions. 4. Verify encryption is enabled for credential transmission.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected switches in separate VLANs with strict access controls
Encrypted Management Channel
allUse SSH or HTTPS for management instead of HTTP/Telnet
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to management interfaces
- Deploy network monitoring to detect credential sniffing attempts
🔍 How to Verify
Check if Vulnerable:
Use network analyzer (Wireshark) to capture traffic to device management interface and check for cleartext credentialsCheck Version:
Check device web interface or CLI for firmware versionVerify Fix Applied:
Verify credentials are no longer visible in cleartext during authentication using network analysis📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts
- Unusual login times/locations
Network Indicators:
- Cleartext authentication traffic to switch management IPs
- ARP spoofing or network sniffing activity
SIEM Query:
source_ip IN (switch_management_ips) AND protocol IN (http, telnet) AND payload CONTAINS 'password'🔗 References
- https://cert.vde.com/en-us/advisories
- https://cert.vde.com/en-us/advisories/vde-2019-018
- https://mdcop.weidmueller.com/mediadelivery/asset/900_102694
- https://www.us-cert.gov/ics/advisories/icsa-19-339-02
- https://cert.vde.com/en-us/advisories
- https://cert.vde.com/en-us/advisories/vde-2019-018
- https://mdcop.weidmueller.com/mediadelivery/asset/900_102694
- https://www.us-cert.gov/ics/advisories/icsa-19-339-02
