Weidmueller: Security routers IE-SR-2TX-WL and IE-SR-2TX-WL-4G are affected by multiple vulnerabilities
Weidmueller security routers IE-SR-2TX-WL and IE-SR-2TX-WL-4G are affected by an unauthenticated remote code execution vulnerability. IE-SR-2TX-WL-4G routers are also affected by a SMS password authorization bypass vulnerability. Weidmueller has released new firmware versions of the affected products to fix the vulnerabilities.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-63587US | high8.6OT erhöht | — | ||
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter o… | ||||
| CVE-2026-63586US | critical9.8 | — | ||
The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header withou… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2026-083: Weidmueller: Security routers IE-SR-2TX-WL and IE-SR-2TX-WL-4G are affected by multiple vulnerabilities - HTMLself
- CERT@VDE Security Advisories for Weidmuellerexternal
- Weidmueller Security Advisory Boardexternal
- VDE-2026-083: Weidmueller: Security routers IE-SR-2TX-WL and IE-SR-2TX-WL-4G are affected by multiple vulnerabilities - CSAFself
Behebungen (4)
- Mitigation
Disable the "Enable reception of SMS control messages" function on IE-SR-2TX-WL-4G devices to prevent unauthorized SMS commands from being executed, until the firmware update is installed.
- Mitigation
Restrict access to the web management interface using firewall rules, access control lists (ACLs), a VPN, or a trusted management network, and ensure the interface is not directly exposed to the public internet, until the firmware update is installed.
- Behoben
Update to the fixed firmware version listed in the remediation table.
- Behoben
Update to the fixed firmware version listed in the remediation table.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan