CVE-2026-63587
Description
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically disabled. An unauthenticated remote attacker who is able to send SMS messages to the device can deliberately trigger this by submitting 5 or more invalid passwords, after which subsequent SMS commands are executed without requiring a password, resulting in potential limited configuration tampering, limited information leakage and potentially full loss of availability.
How to fix
- Weidmueller Interface IE-SR-2TX-WL-4G-EU1.74 or later
- Weidmueller Interface IE-SR-2TX-WL-4G-US-V1.74 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Weidmueller Interface IE-SR-2TX-WL-4G-EU | 1.67 ≤ v < 1.74 | 1.74 |
| Weidmueller Interface IE-SR-2TX-WL-4G-US-V | 1.67 ≤ v < 1.74 | 1.74 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.