Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT are affected by multiple vulnerabilities
Weidmueller security routers IE-SR-4TX and IE-SR-4GT are affected by multiple vulnerabilities (CVE-2026-14167, CVE-2026-14168, CVE-2026-14169, CVE-2026-14171, CVE-2026-2291, CVE-2026-4893, CVE-2026-5172, CVE-2026-40510, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796) in firmware releases prior to V2.3.0 authorization, robustness and redirect flaws in the proprietary configuration interface and web UI, and multiple vulnerabilities in the bundled third-party components dnsmasq, OpenSC and OpenSSL. All are fixed in firmware V2.3.0.
describes (15)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-14171US | — | — | ||
An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of c… | ||||
| CVE-2026-14169US | — | — | ||
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could resul… | ||||
| CVE-2026-14168US | —OT elevated | — | ||
A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system acces… | ||||
| CVE-2026-14167US | —OT elevated | — | ||
A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization. | ||||
| CVE-2026-40510US | medium6.8 | — | ||
OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically presen… | ||||
| CVE-2026-5172US | — | Exploit | ||
A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extra… | ||||
| CVE-2026-4893US | — | Exploit | ||
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information. | ||||
| CVE-2026-2291US | — | Exploit | ||
dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirec… | ||||
| CVE-2026-22796US | — | — | ||
Issue summary: A type confusion vulnerability exists in the signature
verification of signed PKCS#7 data where an ASN1_TYPE union member is
accessed without first validating the ty… | ||||
| CVE-2026-22795US | — | — | ||
Issue summary: An invalid or NULL pointer dereference can happen in
an application processing a malformed PKCS#12 file.
Impact summary: An application processing a malformed PKCS#… | ||||
| CVE-2025-69421US | high7.5 | Exploit | ||
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer
dereference in the PKCS12_item_decrypt_d2i_ex() function.
Impact summary: A NULL pointer dereference… | ||||
| CVE-2025-69420US | — | Exploit | ||
Issue summary: A type confusion vulnerability exists in the TimeStamp Response
verification code where an ASN1_TYPE union member is accessed without first
validating the type, caus… | ||||
| CVE-2025-69419US | — | Exploit | ||
Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously
crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing
non-ASCII BMP code point can tr… | ||||
| CVE-2025-69418US | — | — | ||
Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the… | ||||
| CVE-2025-68160US | — | — | ||
Issue summary: Writing large, newline-free data into a BIO chain using the
line-buffering filter where the next BIO performs short writes can trigger
a heap-based out-of-bounds wri… | ||||
references
External citations — patches, advisories, analysis.
- VDE-2026-081: Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT are affected by multiple vulnerabilities - HTMLself
- CERT@VDE Security Advisories for Weidmuellerexternal
- Weidmueller Security Advisory Boardexternal
- VDE-2026-081: Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT are affected by multiple vulnerabilities - CSAFself
remediations (30)
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
- Mitigation
Exploitation requires physical access. Restrict physical access to the device and to its USB and smart-card interfaces, and do not connect untrusted PIV smart cards or CCID/USB devices.
- Mitigation
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
- Mitigation
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
- Mitigation
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
- Mitigation
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
- Mitigation
Set the DNS proxy to disabled; this closes the DNS port and renders the issue unreachable.
- Mitigation
Set the DNS proxy to disabled; this closes the DNS port and renders the issue unreachable.
- Mitigation
Set the DNS proxy to disabled; this closes the DNS port and renders the issue unreachable.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
- Fixed
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan