EUVD-2026-65328
GHSA-cf4x-hgj3-m8g7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Pre-authentication injection in a network-facing management interface gives AV:N/AC:L/PR:N/UI:N, and root-level command execution yields full C/I/A impact on the same device (S:U).
Primary rating from Vendor (CERTVDE).
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
3DescriptionCVE.org
The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system() function. By submitting a specially crafted username containing shell metacharacters, an unauthenticated attacker with network access to the device can escape the command context and execute arbitrary commands with root privileges.
AnalysisAI
Remote code execution in Weidmueller IE-SR-2TX-WL industrial security routers allows an unauthenticated network attacker to run arbitrary OS commands as root via the web management interface. The modified uhttpd server passes the HTTP Basic Authentication username directly into a shell command, so a crafted username containing shell metacharacters yields full device compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker needs network reachability to the device's web-based management interface (the modified uhttpd service); no credentials, no user interaction, and no non-default configuration are required, since the injection occurs in the HTTP Basic Authentication username handling before authentication is enforced. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the firmware update referenced in the CERT@VDE advisory VDE-2026-083 (https://www.certvde.com/en/advisories/VDE-2026-083/); an exact fixed firmware version is not stated in the provided data, so confirm the patched version directly from that advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Weidmueller IE-SR-2TX-WL routers in your environment, document their network locations and firmware versions, and determine which devices have publicly reachable management interfaces. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today