Skip to content
OpenAdvisories
High VDE-2026-081 15 CVEs

Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT are affected by multiple vulnerabilities

Published Jul 28, 2026 · Updated Jul 28, 2026

Vendor: Weidmueller Product: IE-SR-4GT Product: IE-SR-4GT-LTE/4G-EU Product: IE-SR-4GT-LTE/4G-USEMEA Product: IE-SR-4TX Product: IE-SR-4TX-LTE/4G-EU Product: IE-SR-4TX-LTE/4G-USEMEA

Summary

Weidmueller security routers IE-SR-4TX and IE-SR-4GT are affected by multiple vulnerabilities (CVE-2026-14167, CVE-2026-14168, CVE-2026-14169, CVE-2026-14171, CVE-2026-2291, CVE-2026-4893, CVE-2026-5172, CVE-2026-40510, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796) in firmware releases prior to V2.3.0 authorization, robustness and redirect flaws in the proprietary configuration interface and web UI, and multiple vulnerabilities in the bundled third-party components dnsmasq, OpenSC and OpenSSL. All are fixed in firmware V2.3.0.

Details

Impact
Depending on the flaw, an authenticated user can escalate to administrator privileges, lock out a user account or crash the configuration service and a post-login redirect enables phishing. The bundled third-party components add DNS cache-poisoning / denial of service (dnsmasq), a physical-access smart-card stack overflow (OpenSC) and denial-of-service issues in OpenSSL reachable only by locally parsing crafted PKCS#12/PKCS#7/timestamp input.

Remediation
Update to the new version as listed in the following table:

| Product | Article Number | Firmware File Name | Affected Version | Fixed Version |
|---------------------------------|-----------------|-------------------------------|------------------|---------------|
| IE-SR-4TX | 2751270000 | Firmware_IE-SR-4TX_series | <V2.3.0 | V2.3.0 |
| IE-SR-4TX-LTE/4G-EU | 2751280000 | Firmware_IE-SR-4TX_series | <V2.3.0 | V2.3.0 |
| IE-SR-4TX-LTE/4G-USEMEA | 2739630000 | Firmware_IE-SR-4TX_series | <V2.3.0 | V2.3.0 |
| IE-SR-4GT | 2873910000 | Firmware_IE-SR-4GT_series | <V2.3.0 | V2.3.0 |
| IE-SR-4GT-LTE/4G-EU | 2873920000 | Firmware_IE-SR-4GT_series | <V2.3.0 | V2.3.0 |
| IE-SR-4GT-LTE/4G-USEMEA | 2873930000 | Firmware_IE-SR-4GT_series | <V2.3.0 | V2.3.0 |

Vulnerabilities 15

  • High 8.8
    CVE-2026-14167

    ads-tec Industrial IT: Privilege escalation during configuration import

    A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization.

    ads-tec Industrial IT DVG-IRF1421 DVG-IRF3421 DVG-IRF3821
  • High 8.8
    CVE-2026-14168

    ads-tec Industrial IT: Vertical privilege escalation via configuration table write

    A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access.

    ads-tec Industrial IT DVG-IRF1421 DVG-IRF3421 DVG-IRF3821
  • High 8.1
    CVE-2026-14169

    ads-tec Industrial IT: Account lockout via non-atomic user creation

    Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.

    ads-tec Industrial IT DVG-IRF1421 DVG-IRF3421 DVG-IRF3821
  • High 7.5
    CVE-2025-69420 Public exploit

    Missing ASN1_TYPE validation in TS_RESP_verify_response() function

    Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStam…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2025-69421 Public exploit

    NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function

    Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processi…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2025-69419 Public exploit

    Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

    Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.3
    CVE-2026-2291 Public exploit

    CVE-2026-2291

    dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.

    dnsmasq dnsmasq dnsmasq dnsmasq Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.3
    CVE-2026-5172 Public exploit

    CVE-2026-5172

    A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record’s end.

    dnsmasq dnsmasq dnsmasq dnsmasq Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.1
    CVE-2026-14171

    ads-tec Industrial IT: Post-login open redirect in the web interface

    An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability.

    ads-tec Industrial IT DVG-IRF1421 DVG-IRF3421 DVG-IRF3821
  • Medium 5.5
    CVE-2026-22795

    Missing ASN1_TYPE validation in PKCS#12 parsing

    Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2026-22796

    ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

    Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PK…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2026-4893 Public exploit

    CVE-2026-4893

    An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.

    dnsmasq dnsmasq dnsmasq dnsmasq Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.7
    CVE-2025-68160

    Heap out-of-bounds write in BIO_f_linebuffer on short writes

    Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.0
    CVE-2025-69418

    Unauthenticated/unencrypted trailing bytes with low-level OCB function calls

    Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: Th…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.8
    CVE-2026-40510

    OpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c

    OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card…

    OpenSC OpenSC opensc Azure Linux

Revision history

  1. #1.0.0

    Initial version

References