The IE-SR-2TX-WL-4G-EU device includes an SMS control function that can require password authorization for SMS commands. When the 'Enable Password Authorization' setting is active, the device increments a retry counter on each failed SMS password attempt. After 5 consecutive failed attempts, the device automatically disables SMS password authorization, allowing unauthenticated SMS commands to be executed. An unauthenticated remote attacker who can send SMS messages to the device can exploit this behavior to bypass authentication, potentially causing limited configuration changes, information leakage, or full loss of availability. This vulnerability is identified as CWE-288 and has a CVSS 4.0 score of 8.8 (high severity). The affected version is exactly 1.67. No patch or official remediation has been published as of the data provided.

An unauthenticated remote attacker can bypass SMS password authentication by triggering the automatic disabling of password authorization after multiple failed attempts. This allows the attacker to send SMS commands without authentication, leading to limited configuration tampering, limited information leakage, and potentially full denial of service (loss of availability) on the affected device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict SMS message access to the device from trusted sources only, if possible, to reduce exposure. Monitor device behavior for unauthorized SMS commands. No official patch or workaround has been published at this time.