Skip to content
OpenAdvisories
High VDE-2025-052 5 CVEs

Weidmueller: Security routers IE-SR-2TX are affected by multiple vulnerabilities

Published Jun 11, 2025 · Updated Jul 23, 2025 · Revision 2

Vendor: Weidmüller Product: IE-SR-2TX-WL Product: IE-SR-2TX-WL-4G-EU Product: IE-SR-2TX-WL-4G-US-V

Summary

Weidmueller security routers IE-SR-2TX are affected by multiple vulnerabilities (CVE-2025-41661, CVE-2025-41663, CVE-2025-41683, CVE-2025-41684, CVE-2025-41687).

Weidmueller has released new firmware versions of the affected products to fix the vulnerabilities.

**Update Version 1.1.0:** Added CVEs CVE-2025-41683, CVE-2025-41684 and CVE-2025-41687.
Updated CVSS Score for CVE-2025-41663.
Removed CVE-2025-41662.

Details

Impact
Weidmueller security routers are vulnerable to multiple vulnerabilities, that may lead to execution of arbitrary commands on affected devices with root privileges.

Further information can be found under vulnerability details.

Remediation
Update to the new version as listed in the following table:

| Product | Affected Version | Fixed Version |
|----------------------------------|------------------|---------------|
|IE-SR-2TX-WL | <V1.49 | V1.49 |
|IE-SR-2TX-WL-4G-EU | <V1.62 | V1.62 |
|IE-SR-2TX-WL-4G-US-V | <V1.62 | V1.62 |

Vulnerabilities 5

  • Critical 9.8
    CVE-2025-41663

    Weidmueller: Security routers IE-SR-2TX are affected by Command Injection

    For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH servers, which are then executed with elevated privileges. To get into such a position, clients would need …

    Weidmueller IE-SR-2TX-WL IE-SR-2TX-WL-4G-US-V IE-SR-2TX-WL-4G-EU
  • Critical 9.8
    CVE-2025-41687

    Weidmueller: Unauthenticated Stack-Based Buffer Overflow in u-link Management API

    An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected devices.

    Weidmueller IE-SR-2TX-WL-4G-US-V IE-SR-2TX-WL-4G-EU IE-SR-2TX-WL
  • High 8.8
    CVE-2025-41661

    Weidmueller: Security routers IE-SR-2TX are affected by CSRF

    An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request Forgery (CSRF) protection.

    Weidmueller IE-SR-2TX-WL-4G-EU IE-SR-2TX-WL IE-SR-2TX-WL-4G-US-V
  • High 8.8
    CVE-2025-41683

    Weidmueller: Root Command Injection via Unsanitized Input in event_mail_test Endpoint

    An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint event_mail_test).

    Weidmueller IE-SR-2TX-WL-4G-EU IE-SR-2TX-WL IE-SR-2TX-WL-4G-US-V
  • High 8.8
    CVE-2025-41684

    Weidmueller: Root Command Injection via Unsanitized Input in tls_iotgen_setting Endpoint

    An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint tls_iotgen_setting).

    Weidmueller IE-SR-2TX-WL-4G-EU IE-SR-2TX-WL IE-SR-2TX-WL-4G-US-V

Revision history

  1. #1.1.0

    Added CVEs CVE-2025-41683, CVE-2025-41684 and CVE-2025-41687. Updated CVSS Score for CVE-2025-41663. Removed CVE-2025-41662.

  2. #1.0.0

    Initial version

References