Weidmueller IE-SR-2TX Series Router Pre-Auth RCE and SMS Auth Bypass Advisory

Vulnerability Overview Weidmueller’s Internet Security Routers IE-SR-2TX-WL and IE-SR-2TX-WL-4G contain multiple vulnerabilities. The primary issues include: Unauthenticated Remote Code Execution (RCE) Vulnerability: Attackers can access the device over the network and execute arbitrary shell commands without authentication by injecting specially crafted usernames into the HTTP Basic Authentication header. SMS Password Authorization Bypass Vulnerability: Attackers can disable the SMS password authorization by repeatedly submitting invalid passwords (5 or more times), thereby allowing the execution of SMS commands without a password. Affected Products Affected Products: - IE-SR-2TX-WL (Firmware versions 1.52 < V1.57) - IE-SR-2TX-WL-4G-EU (Firmware versions 1.67 < V1.74) - IE-SR-2TX-WL-4G-US-V (Firmware versions 1.67 < V1.74) CVE Identifiers: - CVE-2026-63586 (CVSS Score: 9.8) - CVE-2026-63587 (CVSS Score: 8.6) Remediation Measures Mitigation: - Restrict access to the web management interface using firewall rules, Access Control Lists (ACLs), Virtual Private Networks (VPNs), or trusted administrative networks, ensuring the interface is not directly exposed to the public internet. - Disable the "Enable Receiving SMS Control Messages" feature on IE-SR-2TX-WL-4G devices to prevent unauthorized execution of SMS commands. Fix: - Update the firmware to the following versions: - Product: IE-SR-2TX-WL - Article Number: 2682590000 - Firmware Filename: FWR_IE-SR-2TX-WL - Affected Versions: IE-SR-2TX-WL Firmware 1.52 < V1.57 - Patched Versions: V1.57 and above Additional Information Release Date: August 25, 2026 Last Updated: August 25, 2026 Vendor: Weidmueller Interface GmbH & Co. KG External ID: VDE-2026-083 Credits CERT@VDE coordinated the response. diconium auto GmbH conducted the penetration testing. Revision History Version 1.0.0: Initial release on August 25, 2026, at 11:00. --- Note: No Proof of Concept (POC) code or exploit code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

Weidmueller IE-SR-2TX Series Router Pre-Auth RCE and SMS Auth Bypass Advisory