Ie Sr 2Tx Wl 4G Eu
Monthly
SMS authentication bypass in Weidmüller IE-SR-2TX-WL-4G industrial 4G routers allows a remote attacker to permanently disable the SMS password requirement by deliberately submitting five or more invalid passwords, after which the device executes all subsequent SMS management commands without any authentication. The root flaw is in the lockout logic: rather than locking out the attacker, the device disables its own password enforcement mechanism, rewarding brute-force attempts with unrestricted SMS command access. Impacts include limited configuration tampering, limited information leakage, and potentially full loss of device availability; no public exploit code or active exploitation is confirmed at time of analysis.
Remote code execution in Weidmueller IE-SR-2TX-WL industrial security routers allows an unauthenticated network attacker to run arbitrary OS commands as root via the web management interface. The modified uhttpd server passes the HTTP Basic Authentication username directly into a shell command, so a crafted username containing shell metacharacters yields full device compromise. No public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a CVSS 4.0 base score of 9.3 (Critical).
SMS authentication bypass in Weidmüller IE-SR-2TX-WL-4G industrial 4G routers allows a remote attacker to permanently disable the SMS password requirement by deliberately submitting five or more invalid passwords, after which the device executes all subsequent SMS management commands without any authentication. The root flaw is in the lockout logic: rather than locking out the attacker, the device disables its own password enforcement mechanism, rewarding brute-force attempts with unrestricted SMS command access. Impacts include limited configuration tampering, limited information leakage, and potentially full loss of device availability; no public exploit code or active exploitation is confirmed at time of analysis.
Remote code execution in Weidmueller IE-SR-2TX-WL industrial security routers allows an unauthenticated network attacker to run arbitrary OS commands as root via the web management interface. The modified uhttpd server passes the HTTP Basic Authentication username directly into a shell command, so a crafted username containing shell metacharacters yields full device compromise. No public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a CVSS 4.0 base score of 9.3 (Critical).