Threats Tagged 'cve-2026-63587'

CVE-2026-63587 is an authentication bypass vulnerability in the Weidmueller IE-SR-2TX-WL-4G-EU device's SMS control function. The device can be configured to require a password for SMS commands, with a retry counter that disables password authorization after 5 failed attempts. An unauthenticated attacker can exploit this by sending 5 invalid SMS password attempts, causing the device to disable password checks and accept subsequent SMS commands without authentication. This can lead to limited configuration tampering, information leakage, and potentially full loss of availability. The vulnerability affects version 1.67 of the device firmware. No patch or official remediation is currently available. The CVSS 4.0 score is 8.8, indicating high severity.

CVE-2026-63586 is a critical OS command injection vulnerability in the Weidmueller Interface IE-SR-2TX-WL device. The web-based management interface uses a modified uhttpd server with CGI shell scripts that improperly handle the HTTP Basic Authentication username. The username is taken directly from the Authorization header without sanitization and inserted into a shell command executed via system(). An unauthenticated attacker with network access can submit a crafted username containing shell metacharacters to execute arbitrary commands with root privileges.