Summary
Weidmueller security routers IE-SR-2TX-WL and IE-SR-2TX-WL-4G are affected by an unauthenticated remote code execution vulnerability. IE-SR-2TX-WL-4G routers are also affected by a SMS password authorization bypass vulnerability.
Weidmueller has released new firmware versions of the affected products to fix the vulnerabilities.
Details
Impact
An attacker with network access to the device can execute arbitrary shell commands with root privileges without authentication, by injecting a specially crafted username into the HTTP Basic Authentication header used by the web management interface. This can be used, for example, to overwrite a script exposed on the web server and create a persistent backdoor.
Additionally, an attacker able to send SMS messages to the IE-SR-2TX-WL-4G variants can disable SMS password authorization by repeatedly submitting invalid passwords (5 or more), after which any SMS command is executed without requiring a password. Commands are limited to availability functions.
Mitigation
Until the firmware update is installed, affected users are strongly advised to:
- Restrict access to the web management interface using firewall rules, access control lists (ACLs), a VPN, or a trusted management network, and ensure the interface is not directly exposed to the public internet.
- Disable the "Enable reception of SMS control messages" function on IE-SR-2TX-WL-4G devices to prevent unauthorized SMS commands from being executed.
Remediation
Update to the new version as listed in the following table:
| Product | Article Number | Firmware File Name | Affected Version | Fixed Version |
|-----------------------|-----------------|-------------------------------|------------------|---------------|
| IE-SR-2TX-WL | 2682590000 | FWR_IE-SR-2TX-WL | <V1.57 | V1.57 |
| IE-SR-2TX-WL-4G-EU | 2682560000 | FWR_IE-SR-2TX-WL-4G-EU_US | <V1.74 | V1.74 |
| IE-SR-2TX-WL-4G-US-V | 2682580000 | FWR_IE-SR-2TX-WL-4G-EU_US | <V1.74 | V1.74 |
Vulnerabilities 2
-
Critical 9.8
Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface
The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system…
-
High 8.6
SMS Password Authorization Bypass via Failed Attempt Counter
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS pa…
Revision history
-
#1.0.0
Initial version
References
-
Weidmueller Security Advisory Board
https://support.weidmueller.com/support-center/popular-resources/security-advisory-board
-
CERT@VDE Security Advisories for Weidmueller
https://certvde.com/de/advisories/vendor/weidmueller/
-
VDE-2026-083: Weidmueller: Security routers IE-SR-2TX-WL and IE-SR-2TX-WL-4G are affected by multiple vulnerabilities - HTML
https://certvde.com/de/advisories/VDE-2026-083